Dark-TRACER: Early Detection Framework for Malware Activity Based on Anomalous Spatiotemporal Patterns

Abstract

As cyberattacks become increasingly prevalent globally, there is a need to identify trends in these cyberattacks and take suitable countermeasures quickly. The darknet, an unused IP address space, is relatively conducive to observing and analyzing indiscriminate cyberattacks because of the absence of legitimate communication. Indiscriminate scanning activities by malware to spread their infections often show similar spatiotemporal patterns, and such trends are also observed on the darknet. To address the problem of early detection of malware activities, we focus on anomalous synchronization of spatiotemporal patterns observed in darknet traffic data. Our previous studies proposed algorithms that automatically estimate and detect anomalous spatiotemporal patterns of darknet traffic in real time by employing three independent machine learning methods. In this study, we integrated the previously proposed methods into a single framework, which we refer to as Dark-TRACER, and conducted quantitative experiments to evaluate its ability to detect these malware activities. We used darknet traffic data from October 2018 to October 2020 observed in our largescale darknet sensors (up to /17 subnet scales). The results demonstrate that the weaknesses of the methods complement each other, and the proposed framework achieves an overall 100% recall rate. In addition, Dark-TRACER detects the average of malware activities 153.6 days earlier than when those malware activities are revealed to the public by reputable third-party security research organizations. Finally, we evaluated the cost of human analysis to implement the proposed system and demonstrated that two analysts can perform the daily operations necessary to operate the framework in approximately 7.3 h.

Mitigate: Toward Comprehensive Research and Development for Analyzing and Combating IoT Malware

“…To solve this issue, we developed an AI-based solution that automatically detects the rise of new malware scanning activities earlier using a large-scale darknet environment (an observation environment using unused IP addresses) [9], [10]. As shown in Fig.…”

“…6, this method focuses on the fact that scanning behavior from hosts infected with the same malware exhibits synchronized characteristics in terms of scanning methods, timing, etc., since the same scan transmission module is used to perform the scan. In other words, when synchronized scan behaviors are detected on the darknet, it can be determined that the group of hosts emitting those scans are infected with the same malware [10]. By using this method, we believe it is possible to catch signs of new malware activity at the earliest possible stage, detect infected host groups, and link this to incident response, including guiding vulnerable equipment users to countermeasures to minimize the damage caused by the malware.…”

A Survey on Deep Learning Techniques for Darknet Traffic Malware Detection

“…Han.Cet al, [11] proposed the model by combining three different machine learning techniques into a single framework called Dark-TRACER, they have proposed algorithms that automatically estimate and detect anomalous spatiotemporal patterns of darknet traffic in real time. They also conducted quantitative experiments to assess this framework's capacity to detect these malware activities.…”