BotDetector: A robust and scalable approach toward detecting malware-infected devices

Sho Mizuno, Mitsuhiro Hatada, Tatsuya Mori, Shigeki Goto

研究成果: Conference contribution

8 被引用数 (Scopus)

抄録

Damage caused by malware is a serious problem that needs to be addressed. The recent rise in the spread of evasive malware has made it difficult to detect it at the pre-infection timing. Malware detection at post-infection timing is a promising approach that fulfills this gap. Given this background, this work aims to identify likely malware-infected devices from the measurement of Internet traffic. The advantage of the traffic-measurement-based approach is that it enables us to monitor a large number of clients. If we find a client as a source of malicious traffic, the client is likely a malware-infected device. Since the majority of malware today makes use of the web as a means to communicate with the C&C servers that reside on the external network, we leverage information recorded in the HTTP headers to discriminate between malicious and legitimate traffic. To make our approach scalable and robust, we develop the automatic template generation scheme that drastically reduces the amount of information to be kept while achieving the high accuracy of classification; since it does not make use of any domain knowledge, the approach should be robust against changes of malware. We apply several classifiers, which include machine learning algorithms, to the extracted templates and classify traffic into two categories: malicious and legitimate. Our extensive experiments demonstrate that our approach discriminates between malicious and legitimate traffic with up to 97.1% precision while maintaining the false positive below 1.0%.

本文言語English
ホスト出版物のタイトル2017 IEEE International Conference on Communications, ICC 2017
編集者Merouane Debbah, David Gesbert, Abdelhamid Mellouk
出版社Institute of Electrical and Electronics Engineers Inc.
ISBN(電子版)9781467389990
DOI
出版ステータスPublished - 2017 7 28
イベント2017 IEEE International Conference on Communications, ICC 2017 - Paris, France
継続期間: 2017 5 212017 5 25

出版物シリーズ

名前IEEE International Conference on Communications
ISSN(印刷版)1550-3607

Other

Other2017 IEEE International Conference on Communications, ICC 2017
国/地域France
CityParis
Period17/5/2117/5/25

ASJC Scopus subject areas

  • コンピュータ ネットワークおよび通信
  • 電子工学および電気工学

フィンガープリント

「BotDetector: A robust and scalable approach toward detecting malware-infected devices」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル