Detecting the Behavioral Relationships of Malware Connections

Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F16%3A00313754" target="_blank" >RIV/68407700:21230/16:00313754 - isvavai.cz</a>
Result on the web
<a href="http://dx.doi.org/10.1145/2970030.2970038" target="_blank" >http://dx.doi.org/10.1145/2970030.2970038</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.1145/2970030.2970038" target="_blank" >10.1145/2970030.2970038</a>

Result language
angličtina
Original language name
Detecting the Behavioral Relationships of Malware Connections
Original language description
A normal computer infected with malware is difficult to detect. There have been several approaches in the last years which analyze the behavior of malware and obtain good results. The malware traffic may be detected, but it is very common to miss-detect normal traffic as malicious and generate false positives. This is specially the case when the methods are tested in real and large networks. The detection errors are generated due to the malware changing and rapidly adapting its domains and patterns to mimic normal connections. To better detect malware infections and separate them from normal traffic we propose to detect the behavior of the group of connections generated by the malware. It is known that malware usually generates various related connections simultaneously and therefore it shows a group pattern. Based on previous experiments, this paper suggests that the behavior of a group of connections can be modelled as a directed cyclic graph with special properties, such as its internal patterns, relationships, frequencies and sequences of connections. By training the group models on known traffic it may be possible to better distinguish between a malware connection and a normal connection. 2016 Copyright held by the owner/author(s).
Czech name
—
Czech description
—

Project
—
Continuities
I - Institucionalni podpora na dlouhodoby koncepcni rozvoj vyzkumne organizace

Publication year
2016
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection
Proceedings of the 1st International Workshop on AI for Privacy and Security
ISBN
978-1-4503-4304-6
ISSN
—
e-ISSN
—
Number of pages
5
Pages from-to
—
Publisher name
ACM
Place of publication
New York
Event location
Hague
Event date
Aug 29, 2016
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
—

Similar results(10)