Detail publikace

Behavior Based Darknet Traffic Decomposition for Malicious Events Identification

ZHANG, R. ZHU, L. LI, X. PANG, S. SARRAFZADEH, A. KOMOSNÝ, D.

Originální název

Behavior Based Darknet Traffic Decomposition for Malicious Events Identification

Typ

článek ve sborníku ve WoS nebo Scopus

Jazyk

angličtina

Originální abstrakt

This paper proposes a host (corresponding to a source IP) behavior based traffic decomposition approach to identify groups of malicious events from massive historical darknet traffic. In our approach, we segmented and extracted traffic flows from captured darknet data, and categorized flows according to a set of rules that summarized from host behavior observations. Finally, significant events are appraised by three criteria: a) the activities within each group should be highly alike; b) the activities should have enough significance in terms of scan scale; and c) the group should be large enough. We applied the approach on a selection of twelve months darknet traffic data for malicious events detection, and the performance of the proposed method has been evaluated.

Klíčová slova

Internet; Darknet; DDoS; Malicious; Events

Autoři

ZHANG, R.; ZHU, L.; LI, X.; PANG, S.; SARRAFZADEH, A.; KOMOSNÝ, D.

Vydáno

9. 11. 2015

ISBN

978-3-319-26555-1

Kniha

Neural Information Processing: 22nd International Conference, ICONIP 2015

Strany od

251

Strany do

260

Strany počet

10

BibTex

@inproceedings{BUT141093,
  author="Ruibin {ZHANG} and Lei {ZHU} and Xiaosong {LI} and Shaoning {Pang} and Abdolhossein {SARRAFZADEH} and Dan {Komosný}",
  title="Behavior Based Darknet Traffic Decomposition for Malicious Events Identification",
  booktitle="Neural Information Processing: 22nd International Conference, ICONIP 2015",
  year="2015",
  pages="251--260",
  doi="10.1007/978-3-319-26555-1\{_}29",
  isbn="978-3-319-26555-1"
}