Malicious Overtones: hunting data theft in the frequency domain with one-class learning
Gorde:
| Argitaratua izan da: | arXiv.org (Apr 9, 2019), p. n/a |
|---|---|
| Egile nagusia: | |
| Argitaratua: |
Cornell University Library, arXiv.org
|
| Gaiak: | |
| Sarrera elektronikoa: | Citation/Abstract Full text outside of ProQuest |
| Etiketak: |
Etiketarik gabe, Izan zaitez lehena erregistro honi etiketa jartzen!
|
MARC
| LEADER | 00000nab a2200000uu 4500 | ||
|---|---|---|---|
| 001 | 2207664779 | ||
| 003 | UK-CbPIL | ||
| 022 | |a 2331-8422 | ||
| 024 | 7 | |a 10.1145/3360469 |2 doi | |
| 035 | |a 2207664779 | ||
| 045 | 0 | |b d20190409 | |
| 100 | 1 | |a Powell, Brian A | |
| 245 | 1 | |a Malicious Overtones: hunting data theft in the frequency domain with one-class learning | |
| 260 | |b Cornell University Library, arXiv.org |c Apr 9, 2019 | ||
| 513 | |a Working Paper | ||
| 520 | 3 | |a A method for detecting electronic data theft from computer networks is described, capable of recognizing patterns of remote exfiltration occurring over days to weeks. Normal traffic flow data, in the form of a host's ingress and egress bytes over time, is used to train an ensemble of one-class learners. The detection ensemble is modular, with individual classifiers trained on different traffic features thought to characterize malicious data transfers. We select features that model the egress to ingress byte balance over time, periodicity, short time-scale irregularity, and density of the traffic. The features are most efficiently modeled in the frequency domain, which has the added benefit that variable duration flows are transformed to a fixed-size feature vector, and by sampling the frequency space appropriately, long-duration flows can be tested. When trained on days- or weeks-worth of traffic from individual hosts, our ensemble achieves a low false positive rate (<2%) on a range of different system types. Simulated exfiltration samples with a variety of different timing and data characteristics were generated and used to test ensemble performance on different kinds of systems: when trained on a client workstation's external traffic, the ensemble was generally successful at detecting exfiltration that is not simultaneously ingress-heavy, connection-sparse, and of short duration---a combination that is not optimal for attackers seeking to transfer large amounts of data. Remote exfiltration is more difficult to detect from egress-heavy systems, like web servers, with normal traffic exhibiting timing characteristics similar to a wide range of exfiltration types. | |
| 653 | |a Egress | ||
| 653 | |a Data transfer (computers) | ||
| 653 | |a Traffic flow | ||
| 653 | |a Workstations | ||
| 653 | |a Hunting | ||
| 653 | |a Periodic variations | ||
| 653 | |a Pattern recognition | ||
| 653 | |a Computer simulation | ||
| 653 | |a Computer networks | ||
| 653 | |a Frequency domain analysis | ||
| 653 | |a Theft | ||
| 653 | |a Servers | ||
| 773 | 0 | |t arXiv.org |g (Apr 9, 2019), p. n/a | |
| 786 | 0 | |d ProQuest |t Engineering Database | |
| 856 | 4 | 1 | |3 Citation/Abstract |u https://www.proquest.com/docview/2207664779/abstract/embedded/6A8EOT78XXH2IG52?source=fedsrch |
| 856 | 4 | 0 | |3 Full text outside of ProQuest |u http://arxiv.org/abs/1904.04895 |