Slow-Paced Persistent Network Attacks Analysis and Detection Using Spectrum Analysis

Abstract

Abstract-A slow-paced persistent attack, such as slow worm or bot, can bewilder the detection system by slowing down their attack. Detecting such attacks based on traditional anomaly detection techniques may yield high false alarm rates. In this paper, we frame our problem as detecting slow-paced persistent attacks from a time series obtained from network trace. We focus on time series spectrum analysis to identify peculiar spectral patterns that may represent the occurrence of a persistent activity in the time domain. We propose a method to adaptively detect slow-paced persistent attacks in a time series and evaluate the proposed method by conducting experiments using both synthesized traffic and real-world traffic. The results show that the proposed method is capable of detecting slow-paced persistent attacks even in a noisy environment mixed with legitimate traffic.

Visualizing Automatically Detected Periodic Network Activity

“…Nearly all studies conducting spectral analysis of network logs for the purpose of intrusion detection use datasets where known "attack" time series are artificially overlaid on top of (either real or synthetic) benign network traffic [2,5,9,12], allowing for algorithmic design to be tailored to the characteristics of the known malicious signal. By contrast, we apply our algorithm to network logs obtained from a large partner organization, where presence of attacks, as well as instances of benign periodic activity, are unknown and unlabeled, and which exhibit larger volumes of automated traffic than can be parsed through manually to separate malicious from benign.…”

“…Chen et al [9] propose an adaptive method to iteratively test for progressively longer periods. This iterative procedure stops when a significant period is detected, and therefore, unlike the method we propose, cannot identify multiple periods present in the same signal.…”

Classification of periodic arrivals in event time data for filtering computer network traffic

“…The problem of periodicity detection in computer network traffic has been extensively studied in the computer science literature. Common approaches include spectral analysis (Barbosa et al 2012;AsSadhan and Moura 2014;Price-Williams et al 2017), which are often combined with thresholding methods (Bartlett et al 2011;Huynh et al 2016;Chen et al 2016). Alternatives include modelling of inter-arrival times (Bilge et al 2012;Qiao et al 2012;Hubballi and Goyal 2013), where distributional assumptions are imposed and the behaviour is tested under the null of no periodicities (He et al 2009;McPherson and Ortega 2011).…”