Network Connectivity Graph for Malicious Traffic Dissection

Abstract

Malware is a major threat to security and privacy of users. A huge variety of malware typically spreads over the Internet, evolving every day, and challenging the research community and security practitioners to improve the effectiveness of countermeasures. In this paper, we present a system that automatically extracts patterns of activity related to a specific malicious event, i.e., a seed. Our system is based on a methodology that correlates events of hosts normally connected to the Internet over (i) time (i.e., analyzing different samples of traffic from the same host), (ii) space (i.e., correlating patterns across different hosts), and (iii) layers (e.g., HTTP, DNS, etc.). The result is a Network Connectivity Graph that captures the overall network behavior of the seed. That is a focused and enriched representation of the malicious pattern infected hosts exhibit, purified from ordinary activities and background traffic. We applied our approach on a large dataset collected in a real commercial ISP where the aggregated traffic produced by more than 20,000 households has been monitored. A commercial IDS has been used to complement data with alerts related to malicious activities. We use such alerts to trigger our processing system. Results shows that the richness of the Network Connectivity Graph provides a much more detailed picture of malicious activities, considerably enhancing our understanding.