Host Behavior in Computer Network: One-Year Study

Abstract

An analysis of a host behavior is an essential key for modern network management and security. A robust behavior profile enables the network managers to detect anomalies with high accuracy, predict the host behavior, or group host to clusters for better management. Hence, host profiling methods attract the interest of many researchers, and novel methods for host profiling are being introduced. However, these methods are frequently developed on preprocessed and small datasets. Therefore, they do not reflect the real-world artifacts of the host profiling, such as missing observations, temporal patterns, or variability in the profile characteristics in time. To provide the needed insight into the artifacts of host profiling in real-world settings, we present a study of the host behavior in a network conducted on a oneyear-long real-world network dataset. In the study, we inspect the availability of the data for host profiling, identify the temporal patterns in host behavior, introduce a method for stable labeling of the hosts, and assess the variability of the host characteristics in the course of the year using the coefficient of variance. Moreover, we make the one-year dataset containing nine characteristics used for host behavior analysis available for public use and further research, including selected use cases representing host profiling caveats. We also share the record of analyses presented in the paper.

IVESA - Visual Analysis of Time-Stamped Event Sequences

“…In five of the six cases, we were also able to identify one domain expert per dataset (see Section 3.3) from the start of the abstractions process. Only for the host behavior case, we initially reused a dataset (and tasks) of a scientific publication [52], and conducted the expert cast and winnow stages [89] later. To design a data-centric but domain-agnostic visualization tool that helps to solve problems encountered by experts across different domains, we engaged with the experts early in the process to learn more about their domain context, usage of the data, current tool usage, problems, and challenges, to identify design targets and determine appropriate validation strategies [77].…”

“…In the Host Behavior case, we analyzed a publicly available dataset of network flows collected by Jirsik and Velan in their 2021 host behavior study [52]. The dataset on the communications flow of a university network consists of 348,574 time-stamped ingress (incoming) and egress (outgoing) communication events.…”

Anteater: Advanced Persistent Threat Detection With Program Network Traffic Behavior

“…To evade detection and blocking of C&C addresses, they are leveraging both host-based and network-based evasion tactics, along with the use of steganography for updating the IP addresses of C&C servers used by malware [6]. Traditional defense mechanisms primarily focus on network-based and signaturebased virus monitoring [7]. However, these methods fall short in effectively intercepting and defending against such threats.…”