An Approach to Malicious Payload Detection

Much of the traffic on the internet consists of network packets which carry data (the payload), with appended headers and other meta-data required for the transport mechanism. The data transport mechanism provides a means for bad actors to transmit malicious data directed at compromising systems. In this research we describe a real-time multi-classifier malicious payload detection system, that could be prevent these type of attacks. The system uses two complementary detection methods one, based on Bayesian inference and two, a multi-feature-vector, both utilizing the same data set for training. The Bayesian inference based uses high order N-gram to extract feature patterns from both normal and anomalous payloads and uses these feature patterns to predict whether the incoming payload is anomalous or normal. In a complementary technique, we derive a multi-feature-vector from normal payloads, which is then used to detect outliers. The system is tested on the HTTP Dataset CSIC 2010 which models a wide variety of attacks. It is experimentally shown that the system is capable of detecting a wide range of anomalous payloads at a high rate of detection.