Detecting the Behavioral Relationships of Malware Connections

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F16%3A00313754" target="_blank" >RIV/68407700:21230/16:00313754 - isvavai.cz</a>

Výsledek na webu

<a href="http://dx.doi.org/10.1145/2970030.2970038" target="_blank" >http://dx.doi.org/10.1145/2970030.2970038</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1145/2970030.2970038" target="_blank" >10.1145/2970030.2970038</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Detecting the Behavioral Relationships of Malware Connections

Popis výsledku v původním jazyce

A normal computer infected with malware is difficult to detect. There have been several approaches in the last years which analyze the behavior of malware and obtain good results. The malware traffic may be detected, but it is very common to miss-detect normal traffic as malicious and generate false positives. This is specially the case when the methods are tested in real and large networks. The detection errors are generated due to the malware changing and rapidly adapting its domains and patterns to mimic normal connections. To better detect malware infections and separate them from normal traffic we propose to detect the behavior of the group of connections generated by the malware. It is known that malware usually generates various related connections simultaneously and therefore it shows a group pattern. Based on previous experiments, this paper suggests that the behavior of a group of connections can be modelled as a directed cyclic graph with special properties, such as its internal patterns, relationships, frequencies and sequences of connections. By training the group models on known traffic it may be possible to better distinguish between a malware connection and a normal connection. 2016 Copyright held by the owner/author(s).

Název v anglickém jazyce

Detecting the Behavioral Relationships of Malware Connections

Popis výsledku anglicky

A normal computer infected with malware is difficult to detect. There have been several approaches in the last years which analyze the behavior of malware and obtain good results. The malware traffic may be detected, but it is very common to miss-detect normal traffic as malicious and generate false positives. This is specially the case when the methods are tested in real and large networks. The detection errors are generated due to the malware changing and rapidly adapting its domains and patterns to mimic normal connections. To better detect malware infections and separate them from normal traffic we propose to detect the behavior of the group of connections generated by the malware. It is known that malware usually generates various related connections simultaneously and therefore it shows a group pattern. Based on previous experiments, this paper suggests that the behavior of a group of connections can be modelled as a directed cyclic graph with special properties, such as its internal patterns, relationships, frequencies and sequences of connections. By training the group models on known traffic it may be possible to better distinguish between a malware connection and a normal connection. 2016 Copyright held by the owner/author(s).

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

20201 - Electrical and electronic engineering

Projekt

—

Návaznosti

I - Institucionalni podpora na dlouhodoby koncepcni rozvoj vyzkumne organizace

Rok uplatnění

2016

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Proceedings of the 1st International Workshop on AI for Privacy and Security

ISBN

978-1-4503-4304-6

ISSN

—

e-ISSN

—

Počet stran výsledku

5

Strana od-do

—

Název nakladatele

ACM

Místo vydání

New York

Místo konání akce

Hague

Datum konání akce

29. 8. 2016

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

—