DarkVec

Abstract

Darknets are passive probes listening to traffic reaching IP addresses that host no services. Traffic reaching them is unsolicited by nature and often induced by scanners, malicious senders and misconfigured hosts. Its peculiar nature makes it a valuable source of information to learn about malicious activities. However, the massive amount of packets and sources that reach darknets makes it hard to extract meaningful insights. In particular, multiple senders contact the darknet while performing similar and coordinated tasks, which are often commanded by common controllers (botnets, crawlers, etc.). How to automatically identify and group those senders that share similar behaviors remains an open problem.We here introduce DarkVec, a methodology to identify clusters of senders (i.e., IP addresses) engaged in similar activities on darknets. DarkVec leverages word embedding techniques (e.g., Word2Vec) to capture the co-occurrence patterns of sources hitting the darknets. We extensively test DarkVec and explore its design space in a case study using one month of darknet data. We show that with a proper definition of service, the generated embeddings can be easily used to (i) associate unknown senders' IP addresses to the correct known labels (more than 96% accuracy), and (ii) identify new attack and scan groups of previously unknown senders. We contribute DarkVec source code and datasets to the community also to stimulate the use of word embeddings to automatically learn patterns on generic traffic traces.

Cross-Network Embeddings Transfer for Traffic Analysis

“…Despite promising recent applications [13], [14], [16], [18], [19], the use of self-supervised AI to learn embeddings from network data is still in its infancy. The same applies to domain adaptation on network-related tasks.…”

“…Recent efforts have noted the similarities between sequences of events observed in network data and of words in natural languages [13], [14], [16]- [19]. Following this intuition, they leverage a two-step pipeline in which embeddings are first learned using techniques like Word2Vec [20], then used in downstream machine learning tasks.…”

“…Authors of [18] follow a similar idea to learn representations for router configuration commands for the purpose of synthesis, verification, and translation. Close to our work, IP2Vec [13], DANTE [14] and DarkVec [16] first learn host embeddings leveraging the sequence of packets observed in network logs. We build on our previous work DarkVec [16] and its incremental training extension i-DarkVec [17], with openly available code, data, and labels.…”

Self-Supervised Latent Representations of Network Flows and Application to Darknet Traffic Classification

“…The authors in [22] introduced DarkVec, an approach to identify clusters of network probers engaged in similar probing activities. DarkVec borrows the concept of the Word2Vec model to find the embedding of a source IP address within the context of a series of IP addresses that hit the network telescope.…”

Does Asm2Vec Reduce Drift on Malware Classification?

“…Similar approaches have been successfully applied in other scenarios, such as code embeddings in which representations are learned from computer languages [Allamanis et al 2018]. These approaches have found several applications in cybersecurity, including for assembly code clone searching [Ding et al 2019], traffic analysis [Gioacchini et al 2021, Le et al 2022, Dietmüller et al 2022, and honeypot log interpretation [Boffa et al 2022].…”