By Topic

Detecting Malware Outbreaks Using a Statistical Model of Blackhole Traffic

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$31 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

3 Author(s)
Soltani, S. ; Dept. of Comput. Sci. & Eng., Michigan State Univ., East Lansing, MI ; Khayam, S.A. ; Radha, H.

Internet blackholes have emerged as very effective tools for monitoring changes in the Internet's traffic behavior. Prior studies have shown that traffic observed at a blackhole contains valuable information about emerging malware. While blackhole traffic has been effectively used for attack forensics, a systematic method of leveraging this traffic for online Internet- scale anomaly detection is not available. In this paper, we propose a novel technique to detect malware outbreaks using deviations in a robust statistical model of a blackhole's traffic. First, we introduce a novel and accurate Piecewise Poisson process Model (PPM) of traffic observed at an Internet Motion Sensor (IMS) blackhole which provides a statistical quantification of the intensity or rate of incoming traffic at a blackhole, which can in turn be used to detect malware outbreaks. After establishing the accuracy of the proposed PPM model, we develop a regression model that can characterize variations in the PPM's traffic rates. Once an accurate model of traffic rates is in place, malware outbreaks can be detected using deviations from the model's likely statistical patterns. After removing simple deterministic patterns, we observe that a blackhole's traffic rate residuals have a skewed and heavy-tailed behavior. Consequently, we employ a stable distribution that models variations in traffic rate residuals with very high accuracy. Finally, we propose an online detection mechanism that utilizes deviations from the rate residual distribution of blackhole traffic data to detect malware outbreaks. Experimental results using the IMS data for approximately one year show that the proposed mechanism accurately detects malware outbreaks in a timely manner.

Published in:

Communications, 2008. ICC '08. IEEE International Conference on

Date of Conference:

19-23 May 2008