Big data is one of the most spotlighted technological trends in these days, enabling new methods to handle huge volume of complicated data for a broad range of applications. Real-time network traffic analysis essentially deals with big data, which is comprised of different types of log data from various sensors. To tackle this problem, in this paper, we devise a big data based platform, RENTAP, to detect and analyse malicious network traffic. Focused on military network environment such as closed network for C4I systems, leading big data based solutions are evaluated to verify which combination of the solutions is the best design for network traffic analysis platform. Based on the selected solutions, we provide detailed functional design of the suggested platform.

No abstract

Identifying the sources of attack packets is the first step in making attackers accountable under the current stateless network routing infrastructure. Several IP packet traceback mechanisms have been designed to attribute the origin of attack conducted not only by flooding network but by single well-targeted packet. However, it is still major challenge to reduce memory space and enhance traceback accuracy in today's high speed networks.In this paper, we propose an Attack Flow Traceback scheme which is based on flow digests and network layer data. Digesting flow instead of individual packet would save memory and be more scalable. Storing network layer data makes it possible to identify attacker node itself on the subnet not the ingress point of an attacking packet and reduce a lot of unnecessary queries which used to be originated in traceback process.

In the past, the number of malware was small, and signature-based anti-virus program could be used to effectively protect the system. Cyber attackers create a large number of variants of malwares with automated tools to avoid signature-based anti-virus programs. Creating signature for all the variants is quite expensive task. To solve this problem, defensive side has been tried to automatically detect the malware variants. Classifying malware families can be one way to solve them. In this paper, we extract novel features from frequency analysis of malware to classify malware family. We separate the malware into section level and apply DCT/DFT to each section. Experimental results show that the proposed method can achieves high accuracy and low operation cost.

No abstract