Real-time detection of global cyberthreat based on darknet by estimating anomalous synchronization using graphical lasso

Chansu Han, Jumpei Shimamura, Takeshi Takahashi, Daisuke Inoue, Junichi Takeuchi, Koji Nakao

研究成果: Contribution to journalArticle査読

抄録

With the rapid evolution and increase of cyberthreats in recent years, it is necessary to detect and understand it promptly and precisely to reduce the impact of cyberthreats. A darknet, which is an unused IP address space, has a high signal-to-noise ratio, so it is easier to understand the global tendency of malicious traffic in cyberspace than other observation networks. In this paper, we aim to capture global cyberthreats in real time. Since multiple hosts infected with similar malware tend to perform similar behavior, we propose a system that estimates a degree of synchronizations from the patterns of packet transmission time among the source hosts observed in unit time of the darknet and detects anomalies in real time. In our evaluation, we perform our proof-of-concept implementation of the proposed engine to demonstrate its feasibility and effectiveness, and we detect cyberthreats with an accuracy of 97.14%. This work is the first practical trial that detects cyberthreats from in-the-wild darknet traffic regardless of new types and variants in real time, and it quantitatively evaluates the result.

本文言語英語
ページ(範囲)2113-2124
ページ数12
ジャーナルIEICE Transactions on Information and Systems
E103D
10
DOI
出版ステータス出版済み - 10 1 2020

All Science Journal Classification (ASJC) codes

  • Software
  • Hardware and Architecture
  • Computer Vision and Pattern Recognition
  • Electrical and Electronic Engineering
  • Artificial Intelligence

フィンガープリント 「Real-time detection of global cyberthreat based on darknet by estimating anomalous synchronization using graphical lasso」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル