Analysis of high volumes of network traffic for Advanced Persistent Threat detection

详细信息    查看全文

• 作者：Mirco Marchetti ^{mirco.marchetti@unimore.it" class="auth_mail" title="E-mail the corresponding author}Author Vitae ; Fabio Pierazzi ; ^{fabio.pierazzi@unimore.it" class="auth_mail" title="E-mail the corresponding author}Author Vitae ; Michele Colajanni ^{michele.colajanni@unimore.it" class="auth_mail" title="E-mail the corresponding author}Author Vitae ; Alessandro Guido ^{alessandro.guido@unimore.it" class="auth_mail" title="E-mail the corresponding author}Author Vitae
• 关键词：Security analytics ; Traffic analysis ; Advanced Persistent Threats ; Data exfiltration
• 刊名：Computer Networks
• 出版年：2016
• 出版时间：9 November 2016
• 年：2016
• 卷：109
• 期：part_P2
• 页码：127-141
• 全文大小：1967 K

文摘

Advanced Persistent Threats (APTs) are the most critical menaces to modern organizations and the most challenging attacks to detect. They span over long periods of time, use encrypted connections and mimic normal behaviors in order to evade detection based on traditional defensive solutions. We propose an innovative approach that is able to analyze efficiently high volumes of network traffic to reveal weak signals related to data exfiltrations and other suspect APT activities. The final result is a ranking of the most suspicious internal hosts; this rank allows security specialists to focus their analyses on a small set of hosts out of the thousands of machines that typically characterize large organizations. Experimental evaluations in a network environment consisting of about 10K hosts show the feasibility and effectiveness of the proposed approach. Our proposal based on security analytics paves the way to novel forms of automatic defense aimed at early detection of APTs in large and continuously varying networked systems.