MAGMA: Network Behavior Classifier for Malware Traffic - IMT - Institut Mines-Télécom Accéder directement au contenu
Article Dans Une Revue Computer Networks "Special issue on Traffic and Performance in the Big Data Era" Année : 2016

MAGMA: Network Behavior Classifier for Malware Traffic

Résumé

Malware is a major threat to security and privacy of network users. A large variety of malware is typically spread over the Internet, hiding in benign traffic. New types of malware appear every day, challenging both the research community and security companies to improve malware identification techniques. In this paper we present MAGMA, MultilAyer Graphs for MAlware detection, a novel malware behavioral classifier. Our system is based on a Big Data methodology, driven by real-world data obtained from traffic traces collected in an operational network. The methodology we propose automatically extracts patterns related to a specific input event, i.e., a seed, from the enormous amount of events the network carries. By correlating such activities over (i) time, (ii) space, and (iii) network protocols, we build a Network Connectivity Graph that captures the overall “network behavior” of the seed. We next extract features from the Connectivity Graph and design a supervised classifier. We run MAGMA on a large dataset collected from a commercial Internet Provider where 20,000 Internet users generated more than 330 million events. Only 42,000 are flagged as malicious by a commercial IDS, which we consider as an oracle. Using this dataset, we experimentally evaluate MAGMA accuracy and robustness to parameter settings. Results indicate that MAGMA reaches 95% accuracy, with limited false positives. Furthermore, MAGMA proves able to identify suspicious network events that the IDS ignored.

Dates et versions

hal-01351259 , version 1 (03-08-2016)

Identifiants

Citer

Enrico Bocchi, Luigi Grimaudo, M. Mellia, Elena Baralis, Sabyasachi Saha, et al.. MAGMA: Network Behavior Classifier for Malware Traffic. Computer Networks "Special issue on Traffic and Performance in the Big Data Era", 2016, ⟨10.1016/j.comnet.2016.03.021⟩. ⟨hal-01351259⟩
232 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More