| IEICE Technical Committee Submission System Conference Paper's Information |
Online Proceedings [Sign in] Tech. Rep. Archives |
| Go Top Page | Go Previous | [Japanese] / [English] |
| Paper Abstract and Keywords | ||
| Presentation | 2021-10-15 16:50 Malware Traffic Detection at Certain Time Using IP Flow Information Seiya Komatsu, Yusei Katsura, Masatoshi Kakiuchi, Ismail Arai, Kazutoshi Fujikawa (NAIST)  IA2021-27 |
|
| Abstract | (in Japanese) | (See Japanese page) |
| (in English) | The damage caused by the activities of malware such as botnets and ransomware has become a social problem. In order to detect malware activity efficiently and reduce the damage, research on detecting malware activity traffic in the network has been proposed. There are three types of traffic information used in these research: packet information, IP flow information, and interface counters information. In the case of using IP flow information, traffic is aggregated in 5-tuples, which is lightweight, but the information is not output until a timeout occurs or the connection is terminated. Therefore, making it difficult to detect scanning activities or long-lasting flows at an early stage. This research aims to maintain the same detection performance as conventional research by modifying the feature while detecting these flows before they terminate. In this paper, we experiment with existing methods that use connection status, port numbers, and transport layer protocols transition of each flow as features. We used the ISCX botnet dataset converted into IP flow information using Zeek to investigate the detection performance when the upper limit of flow duration is not set (the longest flow in the dataset: 240,418 seconds) and when the upper limit is set to 30 seconds. As a result, we confirmed that detection was possible with an F-measure of 98.1% and 96.1%, respectively. From this research, we showed that it is possible to detect malware traffic within 30 seconds (a certain time) with a slight decrease in detection performance. |
|
| Keyword | (in Japanese) | (See Japanese page) |
| (in English) | Malware / Botnet / Malware Detection / Intrusion Detection / Network Security / / / | |
| Reference Info. | IEICE Tech. Rep., vol. 121, no. 201, IA2021-27, pp. 6-11, Oct. 2021. | |
| Paper # | IA2021-27 | |
| Date of Issue | 2021-10-08 (IA) | |
| ISSN | Online edition: ISSN 2432-6380 | |
| Copyright and reproduction |
All rights are reserved and no part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or any information storage and retrieval system, without permission in writing from the publisher. Notwithstanding, instructors are permitted to photocopy isolated articles for noncommercial classroom use without fee. (License No.: 10GA0019/12GB0052/13GB0056/17GB0034/18GB0034) | |
| Download PDF | IA2021-27 |
|
| Conference Information | |
| Committee | IA |
| Conference Date | 2021-10-15 - 2021-10-15 |
| Place (in Japanese) | (See Japanese page) |
| Place (in English) | Online |
| Topics (in Japanese) | (See Japanese page) |
| Topics (in English) | Network R&D Testbed Operation and Utilization, etc. (cosponsored by ADVNET) |
| Paper Information | |
| Registration To | IA |
| Conference Code | 2021-10-IA |
| Language | Japanese |
| Title (in Japanese) | (See Japanese page) |
| Sub Title (in Japanese) | (See Japanese page) |
| Title (in English) | Malware Traffic Detection at Certain Time Using IP Flow Information |
| Sub Title (in English) | |
| Keyword(1) | Malware |
| Keyword(2) | Botnet |
| Keyword(3) | Malware Detection |
| Keyword(4) | Intrusion Detection |
| Keyword(5) | Network Security |
| Keyword(6) | |
| Keyword(7) | |
| Keyword(8) | |
| 1st Author's Name | Seiya Komatsu |
| 1st Author's Affiliation | Nara Institute of Science and Technology (NAIST) |
| 2nd Author's Name | Yusei Katsura |
| 2nd Author's Affiliation | Nara Institute of Science and Technology (NAIST) |
| 3rd Author's Name | Masatoshi Kakiuchi |
| 3rd Author's Affiliation | Nara Institute of Science and Technology (NAIST) |
| 4th Author's Name | Ismail Arai |
| 4th Author's Affiliation | Nara Institute of Science and Technology (NAIST) |
| 5th Author's Name | Kazutoshi Fujikawa |
| 5th Author's Affiliation | Nara Institute of Science and Technology (NAIST) |
| 6th Author's Name | |
| 6th Author's Affiliation | () |
| 7th Author's Name | |
| 7th Author's Affiliation | () |
| 8th Author's Name | |
| 8th Author's Affiliation | () |
| 9th Author's Name | |
| 9th Author's Affiliation | () |
| 10th Author's Name | |
| 10th Author's Affiliation | () |
| 11th Author's Name | |
| 11th Author's Affiliation | () |
| 12th Author's Name | |
| 12th Author's Affiliation | () |
| 13th Author's Name | |
| 13th Author's Affiliation | () |
| 14th Author's Name | |
| 14th Author's Affiliation | () |
| 15th Author's Name | |
| 15th Author's Affiliation | () |
| 16th Author's Name | |
| 16th Author's Affiliation | () |
| 17th Author's Name | |
| 17th Author's Affiliation | () |
| 18th Author's Name | |
| 18th Author's Affiliation | () |
| Speaker | Author-1 |
| Date Time | 2021-10-15 16:50:00 |
| Presentation Time | 25 minutes |
| Registration for | IA |
| Paper # | IA2021-27 |
| Volume (vol) | vol.121 |
| Number (no) | no.201 |
| Page | pp.6-11 |
| #Pages | 6 |
| Date of Issue | 2021-10-08 (IA) |
[Return to Top Page]