Abstract
Recent malware evolutions have rendered cyberspace less secure, and we are currently witnessing an increasing number of severe security incidents. To minimize the impact of malware activities, it is important to detect them promptly and precisely. We have been working on this issue by monitoring traffic coming into unused IP address spaces, i.e., the darknet. On our darknet, Internet-wide scans from malware are observed as if they are coordinated or working cooperatively. Based on this observation, our earlier method monitored network traffic arriving at our darknet, estimated the degree of cooperation between each pair of the source hosts, and detected significant changes in cooperation among source hosts as a sign of newly activated malware activities. However, this method does not work in real time, and thus, it is impractical. In this study, we extend our earlier work and propose an online processing algorithm, making it possible to detect malware activities in real time. In our evaluation, we measure the detection performance of the proposed method with our proof-of-concept implementation to demonstrate its feasibility and effectiveness in terms of detecting the rise of new malware activities in real time.
| Original language | English |
|---|---|
| Title of host publication | Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019 |
| Publisher | Institute of Electrical and Electronics Engineers Inc. |
| Pages | 144-151 |
| Number of pages | 8 |
| ISBN (Electronic) | 9781728127767 |
| DOIs | |
| Publication status | Published - Aug 2019 |
| Event | 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019 - Rotorua, New Zealand Duration: Aug 5 2019 → Aug 8 2019 |
Publication series
| Name | Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019 |
|---|
Conference
| Conference | 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019 |
|---|---|
| Country | New Zealand |
| City | Rotorua |
| Period | 8/5/19 → 8/8/19 |
Fingerprint
All Science Journal Classification (ASJC) codes
- Computer Networks and Communications
- Software
- Information Systems and Management
- Safety, Risk, Reliability and Quality
- Artificial Intelligence
Cite this
Real-time detection of malware activities by analyzing darknet traffic using graphical lasso. / Han, Chansu; Shimamura, Jumpei; Takahashi, Takeshi; Inoue, Daisuke; Kawakita, Masanori; Takeuchi, Jun'Ichi; Nakao, Koji.
Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019. Institute of Electrical and Electronics Engineers Inc., 2019. p. 144-151 8887373 (Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019).Research output: Chapter in Book/Report/Conference proceeding › Conference contribution
}
TY - GEN
T1 - Real-time detection of malware activities by analyzing darknet traffic using graphical lasso
AU - Han, Chansu
AU - Shimamura, Jumpei
AU - Takahashi, Takeshi
AU - Inoue, Daisuke
AU - Kawakita, Masanori
AU - Takeuchi, Jun'Ichi
AU - Nakao, Koji
PY - 2019/8
Y1 - 2019/8
N2 - Recent malware evolutions have rendered cyberspace less secure, and we are currently witnessing an increasing number of severe security incidents. To minimize the impact of malware activities, it is important to detect them promptly and precisely. We have been working on this issue by monitoring traffic coming into unused IP address spaces, i.e., the darknet. On our darknet, Internet-wide scans from malware are observed as if they are coordinated or working cooperatively. Based on this observation, our earlier method monitored network traffic arriving at our darknet, estimated the degree of cooperation between each pair of the source hosts, and detected significant changes in cooperation among source hosts as a sign of newly activated malware activities. However, this method does not work in real time, and thus, it is impractical. In this study, we extend our earlier work and propose an online processing algorithm, making it possible to detect malware activities in real time. In our evaluation, we measure the detection performance of the proposed method with our proof-of-concept implementation to demonstrate its feasibility and effectiveness in terms of detecting the rise of new malware activities in real time.
AB - Recent malware evolutions have rendered cyberspace less secure, and we are currently witnessing an increasing number of severe security incidents. To minimize the impact of malware activities, it is important to detect them promptly and precisely. We have been working on this issue by monitoring traffic coming into unused IP address spaces, i.e., the darknet. On our darknet, Internet-wide scans from malware are observed as if they are coordinated or working cooperatively. Based on this observation, our earlier method monitored network traffic arriving at our darknet, estimated the degree of cooperation between each pair of the source hosts, and detected significant changes in cooperation among source hosts as a sign of newly activated malware activities. However, this method does not work in real time, and thus, it is impractical. In this study, we extend our earlier work and propose an online processing algorithm, making it possible to detect malware activities in real time. In our evaluation, we measure the detection performance of the proposed method with our proof-of-concept implementation to demonstrate its feasibility and effectiveness in terms of detecting the rise of new malware activities in real time.
UR - http://www.scopus.com/inward/record.url?scp=85075142017&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85075142017&partnerID=8YFLogxK
U2 - 10.1109/TrustCom/BigDataSE.2019.00028
DO - 10.1109/TrustCom/BigDataSE.2019.00028
M3 - Conference contribution
AN - SCOPUS:85075142017
T3 - Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019
SP - 144
EP - 151
BT - Proceedings - 2019 18th IEEE International Conference on Trust, Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering, TrustCom/BigDataSE 2019
PB - Institute of Electrical and Electronics Engineers Inc.
ER -