King's College London

Research portal

Analysis of high volumes of network traffic for Advanced Persistent Threat detection

Research output: Contribution to journalArticlepeer-review

Mirco Marchetti, Fabio Pierazzi, Michele Colajanni, Alessandro Guido

Original languageEnglish
Pages (from-to)127-141
Number of pages15
JournalCOMPUTER NETWORKS
Volume109
Early online date1 Jun 2016
DOIs
Accepted/In press25 May 2016
E-pub ahead of print1 Jun 2016
Published9 Nov 2016

Documents

King's Authors

Abstract

Advanced Persistent Threats (APTs) are the most critical menaces to modern organizations and the most challenging attacks to detect. They span over long periods of time, use encrypted connections and mimic normal behaviors in order to evade detection based on traditional defensive solutions. We propose an innovative approach that is able to analyze efficiently high volumes of network traffic to reveal weak signals related to data exfiltrations and other suspect APT activities. The final result is a ranking of the most suspicious internal hosts; this rank allows security specialists to focus their analyses on a small set of hosts out of the thousands of machines that typically characterize large organizations. Experimental evaluations in a network environment consisting of about 10K hosts show the feasibility and effectiveness of the proposed approach. Our proposal based on security analytics paves the way to novel forms of automatic defense aimed at early detection of APTs in large and continuously varying networked systems.

Download statistics

No data available

View graph of relations

© 2020 King's College London | Strand | London WC2R 2LS | England | United Kingdom | Tel +44 (0)20 7836 5454