Network Connectivity Graph for Malicious Traffic Dissection

Abstract : Malware is a major threat to security and privacy of network users. A huge variety of malware typically spreads over the Internet, evolving every day, and challenging the research community and security practitioners to improve the effectiveness of countermeasures. In this paper, we present a system that automatically extracts patterns of network activity related to a specific malicious event, i.e., a seed. Our system is based on a methodology that correlates network events of hosts normally connected to the Internet over (i) time (i.e., analyzing different samples of traffic from the same host), (ii) space (i.e., correlating patterns across different hosts), and (iii) network layers (e.g., HTTP, DNS, etc.). The result is a Network Connectivity Graph that captures the overall "network behavior" of the seed. That is a focused and enriched representation of the malicious pattern infected hosts exhibit, purified from ordinary network activities and background traffic. We applied our approach on a large dataset collected in a real commercial ISP where the aggregated traffic produced by more than 20,000 households has been monitored. A commercial IDS has been used to complement network data with alerts related to malicious activities. We use such alerts to trigger our processing system. Results shows that the richness of the Network Connectivity Graph provides a much more detailed picture of malicious activities, considerably enhancing our understanding.
Document type :
Conference papers
Complete list of metadatas

https://hal.archives-ouvertes.fr/hal-01254716
Contributor : Enrico Bocchi <>
Submitted on : Tuesday, January 12, 2016 - 3:53:32 PM
Last modification on : Wednesday, December 18, 2019 - 5:12:12 PM

Links full text

Identifiers

Citation

Enrico Bocchi, Luigi Grimaudo, Marco Mellia, Baralis Elena, Sabyasachi Saha, et al.. Network Connectivity Graph for Malicious Traffic Dissection. 2015 24th International Conference on Computer Communication and Networks (ICCCN), Aug 2015, Las Vegas, United States. pp.1 -- 9 ⟨10.1109/ICCCN.2015.7288435⟩. ⟨hal-01254716⟩

Share

Metrics

Record views

167