Real-time detection of malware activities by analyzing darknet traffic using graphical lasso

Chansu Han, Jumpei Shimamura, Takeshi Takahashi, Daisuke Inoue, Masanori Kawakita, Jun'Ichi Takeuchi, Koji Nakao

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Recent malware evolutions have rendered cyberspace less secure, and we are currently witnessing an increasing number of severe security incidents. To minimize the impact of malware activities, it is important to detect them promptly and precisely. We have been working on this issue by monitoring traffic coming into unused IP address spaces, i.e., the darknet. On our darknet, Internet-wide scans from malware are observed as if they are coordinated or working cooperatively. Based on this observation, our earlier method monitored network traffic arriving at our darknet, estimated the degree of cooperation between each pair of the source hosts, and detected significant changes in cooperation among source hosts as a sign of newly activated malware activities. However, this method does not work in real time, and thus, it is impractical. In this study, we extend our earlier work and propose an online processing algorithm, making it possible to detect malware activities in real time. In our evaluation, we measure the detection performance of the proposed method with our proof-of-concept implementation to demonstrate its feasibility and effectiveness in terms of detecting the rise of new malware activities in real time.

Original languageEnglish
Title of host publicationProceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages144-151
Number of pages8
ISBN (Electronic)9781728127767
DOIs
Publication statusPublished - Aug 2019
Event18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019 - Rotorua, New Zealand
Duration: Aug 5 2019Aug 8 2019

Publication series

NameProceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019

Conference

Conference18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019
CountryNew Zealand
CityRotorua
Period8/5/198/8/19

Fingerprint

Malware
Internet
Monitoring
Processing
Incidents
Cyberspace
Evaluation
World Wide Web

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications
  • Software
  • Information Systems and Management
  • Safety, Risk, Reliability and Quality
  • Artificial Intelligence

Cite this

Han, C., Shimamura, J., Takahashi, T., Inoue, D., Kawakita, M., Takeuchi, JI., & Nakao, K. (2019). Real-time detection of malware activities by analyzing darknet traffic using graphical lasso. In Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019 (pp. 144-151). [8887373] (Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/TrustCom/BigDataSE.2019.00028

Real-time detection of malware activities by analyzing darknet traffic using graphical lasso. / Han, Chansu; Shimamura, Jumpei; Takahashi, Takeshi; Inoue, Daisuke; Kawakita, Masanori; Takeuchi, Jun'Ichi; Nakao, Koji.

Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019. Institute of Electrical and Electronics Engineers Inc., 2019. p. 144-151 8887373 (Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Han, C, Shimamura, J, Takahashi, T, Inoue, D, Kawakita, M, Takeuchi, JI & Nakao, K 2019, Real-time detection of malware activities by analyzing darknet traffic using graphical lasso. in Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019., 8887373, Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019, Institute of Electrical and Electronics Engineers Inc., pp. 144-151, 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019, Rotorua, New Zealand, 8/5/19. https://doi.org/10.1109/TrustCom/BigDataSE.2019.00028
Han C, Shimamura J, Takahashi T, Inoue D, Kawakita M, Takeuchi JI et al. Real-time detection of malware activities by analyzing darknet traffic using graphical lasso. In Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019. Institute of Electrical and Electronics Engineers Inc. 2019. p. 144-151. 8887373. (Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019). https://doi.org/10.1109/TrustCom/BigDataSE.2019.00028
Han, Chansu ; Shimamura, Jumpei ; Takahashi, Takeshi ; Inoue, Daisuke ; Kawakita, Masanori ; Takeuchi, Jun'Ichi ; Nakao, Koji. / Real-time detection of malware activities by analyzing darknet traffic using graphical lasso. Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019. Institute of Electrical and Electronics Engineers Inc., 2019. pp. 144-151 (Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019).
@inproceedings{99500afcd791475aab41ab3d7b2f37f7,
title = "Real-time detection of malware activities by analyzing darknet traffic using graphical lasso",
abstract = "Recent malware evolutions have rendered cyberspace less secure, and we are currently witnessing an increasing number of severe security incidents. To minimize the impact of malware activities, it is important to detect them promptly and precisely. We have been working on this issue by monitoring traffic coming into unused IP address spaces, i.e., the darknet. On our darknet, Internet-wide scans from malware are observed as if they are coordinated or working cooperatively. Based on this observation, our earlier method monitored network traffic arriving at our darknet, estimated the degree of cooperation between each pair of the source hosts, and detected significant changes in cooperation among source hosts as a sign of newly activated malware activities. However, this method does not work in real time, and thus, it is impractical. In this study, we extend our earlier work and propose an online processing algorithm, making it possible to detect malware activities in real time. In our evaluation, we measure the detection performance of the proposed method with our proof-of-concept implementation to demonstrate its feasibility and effectiveness in terms of detecting the rise of new malware activities in real time.",
author = "Chansu Han and Jumpei Shimamura and Takeshi Takahashi and Daisuke Inoue and Masanori Kawakita and Jun'Ichi Takeuchi and Koji Nakao",
year = "2019",
month = "8",
doi = "10.1109/TrustCom/BigDataSE.2019.00028",
language = "English",
series = "Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
pages = "144--151",
booktitle = "Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019",
address = "United States",

}

TY - GEN

T1 - Real-time detection of malware activities by analyzing darknet traffic using graphical lasso

AU - Han, Chansu

AU - Shimamura, Jumpei

AU - Takahashi, Takeshi

AU - Inoue, Daisuke

AU - Kawakita, Masanori

AU - Takeuchi, Jun'Ichi

AU - Nakao, Koji

PY - 2019/8

Y1 - 2019/8

N2 - Recent malware evolutions have rendered cyberspace less secure, and we are currently witnessing an increasing number of severe security incidents. To minimize the impact of malware activities, it is important to detect them promptly and precisely. We have been working on this issue by monitoring traffic coming into unused IP address spaces, i.e., the darknet. On our darknet, Internet-wide scans from malware are observed as if they are coordinated or working cooperatively. Based on this observation, our earlier method monitored network traffic arriving at our darknet, estimated the degree of cooperation between each pair of the source hosts, and detected significant changes in cooperation among source hosts as a sign of newly activated malware activities. However, this method does not work in real time, and thus, it is impractical. In this study, we extend our earlier work and propose an online processing algorithm, making it possible to detect malware activities in real time. In our evaluation, we measure the detection performance of the proposed method with our proof-of-concept implementation to demonstrate its feasibility and effectiveness in terms of detecting the rise of new malware activities in real time.

AB - Recent malware evolutions have rendered cyberspace less secure, and we are currently witnessing an increasing number of severe security incidents. To minimize the impact of malware activities, it is important to detect them promptly and precisely. We have been working on this issue by monitoring traffic coming into unused IP address spaces, i.e., the darknet. On our darknet, Internet-wide scans from malware are observed as if they are coordinated or working cooperatively. Based on this observation, our earlier method monitored network traffic arriving at our darknet, estimated the degree of cooperation between each pair of the source hosts, and detected significant changes in cooperation among source hosts as a sign of newly activated malware activities. However, this method does not work in real time, and thus, it is impractical. In this study, we extend our earlier work and propose an online processing algorithm, making it possible to detect malware activities in real time. In our evaluation, we measure the detection performance of the proposed method with our proof-of-concept implementation to demonstrate its feasibility and effectiveness in terms of detecting the rise of new malware activities in real time.

UR - http://www.scopus.com/inward/record.url?scp=85075142017&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85075142017&partnerID=8YFLogxK

U2 - 10.1109/TrustCom/BigDataSE.2019.00028

DO - 10.1109/TrustCom/BigDataSE.2019.00028

M3 - Conference contribution

AN - SCOPUS:85075142017

T3 - Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019

SP - 144

EP - 151

BT - Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019

PB - Institute of Electrical and Electronics Engineers Inc.

ER -