Loading [MathJax]/extensions/MathMenu.js
Distilling command and control network intrusions from network flow metadata using temporal PageRank | IEEE Conference Publication | IEEE Xplore

Distilling command and control network intrusions from network flow metadata using temporal PageRank


Abstract:

Malicious network intrusions which exfiltrate data from computer networks are extremely damaging for organisations and governments worldwide. Combating these network intr...Show More

Abstract:

Malicious network intrusions which exfiltrate data from computer networks are extremely damaging for organisations and governments worldwide. Combating these network intrusions and large-scale cyber-attacks requires mining and analysis of large volumes of computer network data. We present a statistical filtering and temporal PageRank technique that improves the probability of discovering network intrusions. The technique filters out benign network data such that the data remaining is more pertinent and likely to contain malicious command and control (C2) traffic. We then propose a novel application of Google's PageRank algorithm by incorporating temporal analysis and evaluating a time-series of page rankings for identifying C2 like traffic. Two case studies using data collected at the gateway of an enterprise network and at the Internet backbone are presented to support our technique.
Date of Conference: 07-09 December 2016
Date Added to IEEE Xplore: 16 March 2017
ISBN Information:
Electronic ISSN: 2474-154X
Conference Location: Dunedin, New Zealand

Contact IEEE to Subscribe

References

References is not available for this document.