Abstract:
Malicious network intrusions which exfiltrate data from computer networks are extremely damaging for organisations and governments worldwide. Combating these network intr...Show MoreMetadata
Abstract:
Malicious network intrusions which exfiltrate data from computer networks are extremely damaging for organisations and governments worldwide. Combating these network intrusions and large-scale cyber-attacks requires mining and analysis of large volumes of computer network data. We present a statistical filtering and temporal PageRank technique that improves the probability of discovering network intrusions. The technique filters out benign network data such that the data remaining is more pertinent and likely to contain malicious command and control (C2) traffic. We then propose a novel application of Google's PageRank algorithm by incorporating temporal analysis and evaluating a time-series of page rankings for identifying C2 like traffic. Two case studies using data collected at the gateway of an enterprise network and at the Internet backbone are presented to support our technique.
Published in: 2016 26th International Telecommunication Networks and Applications Conference (ITNAC)
Date of Conference: 07-09 December 2016
Date Added to IEEE Xplore: 16 March 2017
ISBN Information:
Electronic ISSN: 2474-154X