Abstract:Anomaly detection is an important technique used to identify patterns of unusual network behavior and keep the network under control. Today, network attacks are increasing in terms of both their number and sophistication. To avoid causing significant traffic patterns and being detected by existing techniques, many new attacks tend to involve gradual adjustment of behaviors, which always generate incomplete sessions due to their running mechanisms. Accordingly, in this work, we employ the behavior symmetry degree to profile the anomalies and further identify unusual behaviors. We first proposed a symmetry degree to identify the incomplete sessions generated by unusual behaviors; we then employ a sketch to calculate the symmetry degree of internal hosts to improve the identification efficiency for online applications. To reduce the memory cost and probability of collision, we divide the IP addresses into four segments that can be used as keys of the hash functions in the sketch. Moreover, to further improve detection accuracy, a threshold selection method is proposed for dynamic traffic pattern analysis. The hash functions in the sketch are then designed using Chinese remainder theory, which can analytically trace the IP addresses associated with the anomalies. We tested the proposed techniques based on traffic data collected from the northwest center of CERNET (China Education and Research Network); the results show that the proposed methods can effectively detect anomalies in large-scale networks.

A Registry Table Anomaly Behaviors Detecting Technology for Recognizing Malicious Scripts

Defense of Hidden Backdoor Technology for Web

An Abnormal Network Behavior Detection System Based on Compound Session

Malicious behavior monitoring technology based on Windows Service

Real-Time Behavior Analysis and Identification for Android Application

Technique of Detecting Malicious Executables Via Behavioral and Binary Signatures

Design and Implementation of Program Behavior Anomaly Detection System Based on System Service Hook

A Static Method for Detection of Information Theft Malware

Web Page Trojan Detection Method Based on Dynamic Behavior Analysis

Malware Profiler Based on Innovative Behavior-Awareness Technique

Behavior-Based Proactive Detection of Unknown Malicious Codes

Design and Implementation of Malware Automated Analysis Tool Based on Behavior Analysis

A Rough Set Approach To Abnormal Behavior Detection In Computer Systems

Prototype demonstration: trojan detection and defense system

A Rough Set Theory Based Method for Anomaly Intrusion Detection in Computer Network Systems

The Design and Implementation of Suspicious Sample Collection System based on Windows Kernel Driver

Anomaly Detection Model Based on Windows Native API Sequences

An APP Sensitive Behaviors Detection Method Based on Android Kernel and Its Implementation

Anomaly Detection for malware identification using Hardware Performance Counters

Symmetry Degree Measurement and Its Applications to Anomaly Detection

Design and Implementation of Program Behavior Analysis System at Ring 0 Level