Login | Register

FINGERPRINTING MALICIOUS IP TRAFFIC

Title:

FINGERPRINTING MALICIOUS IP TRAFFIC

Lakhdari, Nour-Eddine (2014) FINGERPRINTING MALICIOUS IP TRAFFIC. Masters thesis, Concordia University.

[img]
Preview
Text (application/pdf)
Lakhdari_MASc_S2014.pdf - Accepted Version
3MB

Abstract

In the new global economy, cyber-attacks have become a central issue. The detection, mitigation and attribution of such cyber-attacks require efficient and practical techniques to fingerprint malicious IP traffic. By fingerprinting, we refer to: (1) the detection of malicious network flows and, (2) the attribution of the detected flows to malware families that generate them. In this thesis, we firstly address the detection problem and solve it by using a classification technique. The latter uses features that exploit only high-level properties of traffic flows and therefore does not rely on deep packet inspection. As such, our technique is effective even in the presence of encrypted traffic. Secondly, whenever a malicious flow is detected, we propose another technique to attribute such a flow to the malware family that generated it. The attribution technique is built upon k-means clustering, sequence mining and Pushdown Automata (PDAs) to capture the network behaviors of malware family groups. Indeed, the generated PDAs are actually network signatures for malware family groups. Our results show that the proposed malicious detection and attribution techniques achieve high accuracy with low false (positive and negative) alerts.

Divisions:Concordia University > Gina Cody School of Engineering and Computer Science > Concordia Institute for Information Systems Engineering
Item Type:Thesis (Masters)
Authors:Lakhdari, Nour-Eddine
Institution:Concordia University
Degree Name:M.A. Sc.
Program:Information Systems Security
Date:21 March 2014
ID Code:978357
Deposited By: Mr. NOUR-EDDINE LAKHDARI
Deposited On:19 Jun 2014 17:04
Last Modified:18 Jan 2018 17:46
All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Downloads per month over past year

Back to top Back to top