Detecting malicious sessions through traffic fingerprinting using hidden markov models

Sami Zhioua; Adnene Ben Jabeur; Mahjoub Langar; Wael Ilahi

doi:10.1007/978-3-319-23829-6_47

Detecting malicious sessions through traffic fingerprinting using hidden markov models

Sami Zhioua^*, Adnene Ben Jabeur, Mahjoub Langar, Wael Ilahi

^*Corresponding author for this work

King Fahd University of Petroleum & Minerals

Research output: Chapter in Book/Report/Conference proceeding › Chapter › peer-review

2 Scopus citations

Abstract

Almost any malware attack involves data communication between the infected host and the attacker host/server allowing the latter to remotely control the infected host. The remote control is achieved through opening different types of sessions such as remote desktop, webcam video streaming, file transfer, etc. In this paper, we present a traffic analysis based malware detection technique using Hidden Markov Model (HMM). The main contribution is that the proposed system does not only detect malware infections but also identifies with precision the type of malicious session opened by the attacker. The empirical analysis shows that the proposed detection system has a stable identification precision of 90% and that it allows to identify between 40% and 75% of all malicious sessions in typical network traffic.

Original language	English
Title of host publication	Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST
Publisher	Springer Verlag
Pages	623-631
Number of pages	9
DOIs	https://doi.org/10.1007/978-3-319-23829-6_47
State	Published - 2015

Publication series

Name	Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST
Volume	152
ISSN (Print)	1867-8211

Bibliographical note

Publisher Copyright:
© Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2015.

Keywords

HiddenMarkovModel (HMM)
Malicious sessions
Malware detection
Traffic analysis

ASJC Scopus subject areas

Computer Networks and Communications

Access to Document

10.1007/978-3-319-23829-6_47

Cite this

Zhioua, S., Jabeur, A. B., Langar, M., & Ilahi, W. (2015). Detecting malicious sessions through traffic fingerprinting using hidden markov models. In Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST (pp. 623-631). (Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST; Vol. 152). Springer Verlag. https://doi.org/10.1007/978-3-319-23829-6_47

Zhioua, Sami ; Jabeur, Adnene Ben ; Langar, Mahjoub et al. / Detecting malicious sessions through traffic fingerprinting using hidden markov models. Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST. Springer Verlag, 2015. pp. 623-631 (Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST).

@inbook{f20d4a8520014a05b0bad37ee04fe1d2,

title = "Detecting malicious sessions through traffic fingerprinting using hidden markov models",

abstract = "Almost any malware attack involves data communication between the infected host and the attacker host/server allowing the latter to remotely control the infected host. The remote control is achieved through opening different types of sessions such as remote desktop, webcam video streaming, file transfer, etc. In this paper, we present a traffic analysis based malware detection technique using Hidden Markov Model (HMM). The main contribution is that the proposed system does not only detect malware infections but also identifies with precision the type of malicious session opened by the attacker. The empirical analysis shows that the proposed detection system has a stable identification precision of 90% and that it allows to identify between 40% and 75% of all malicious sessions in typical network traffic.",

keywords = "HiddenMarkovModel (HMM), Malicious sessions, Malware detection, Traffic analysis",

author = "Sami Zhioua and Jabeur, {Adnene Ben} and Mahjoub Langar and Wael Ilahi",

note = "Publisher Copyright: {\textcopyright} Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2015.",

year = "2015",

doi = "10.1007/978-3-319-23829-6_47",

language = "English",

series = "Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST",

publisher = "Springer Verlag",

pages = "623--631",

booktitle = "Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST",

address = "Germany",

}

Zhioua, S, Jabeur, AB, Langar, M & Ilahi, W 2015, Detecting malicious sessions through traffic fingerprinting using hidden markov models. in Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST. Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST, vol. 152, Springer Verlag, pp. 623-631. https://doi.org/10.1007/978-3-319-23829-6_47

Detecting malicious sessions through traffic fingerprinting using hidden markov models. / Zhioua, Sami; Jabeur, Adnene Ben; Langar, Mahjoub et al.
Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST. Springer Verlag, 2015. p. 623-631 (Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST; Vol. 152).

Research output: Chapter in Book/Report/Conference proceeding › Chapter › peer-review

TY - CHAP

T1 - Detecting malicious sessions through traffic fingerprinting using hidden markov models

AU - Zhioua, Sami

AU - Jabeur, Adnene Ben

AU - Langar, Mahjoub

AU - Ilahi, Wael

PY - 2015

Y1 - 2015

N2 - Almost any malware attack involves data communication between the infected host and the attacker host/server allowing the latter to remotely control the infected host. The remote control is achieved through opening different types of sessions such as remote desktop, webcam video streaming, file transfer, etc. In this paper, we present a traffic analysis based malware detection technique using Hidden Markov Model (HMM). The main contribution is that the proposed system does not only detect malware infections but also identifies with precision the type of malicious session opened by the attacker. The empirical analysis shows that the proposed detection system has a stable identification precision of 90% and that it allows to identify between 40% and 75% of all malicious sessions in typical network traffic.

AB - Almost any malware attack involves data communication between the infected host and the attacker host/server allowing the latter to remotely control the infected host. The remote control is achieved through opening different types of sessions such as remote desktop, webcam video streaming, file transfer, etc. In this paper, we present a traffic analysis based malware detection technique using Hidden Markov Model (HMM). The main contribution is that the proposed system does not only detect malware infections but also identifies with precision the type of malicious session opened by the attacker. The empirical analysis shows that the proposed detection system has a stable identification precision of 90% and that it allows to identify between 40% and 75% of all malicious sessions in typical network traffic.

KW - HiddenMarkovModel (HMM)

KW - Malicious sessions

KW - Malware detection

KW - Traffic analysis

UR - http://www.scopus.com/inward/record.url?scp=84948146591&partnerID=8YFLogxK

U2 - 10.1007/978-3-319-23829-6_47

DO - 10.1007/978-3-319-23829-6_47

M3 - Chapter

AN - SCOPUS:84948146591

T3 - Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST

SP - 623

EP - 631

BT - Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST

PB - Springer Verlag

ER -

Zhioua S, Jabeur AB, Langar M, Ilahi W. Detecting malicious sessions through traffic fingerprinting using hidden markov models. In Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST. Springer Verlag. 2015. p. 623-631. (Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST). doi: 10.1007/978-3-319-23829-6_47

Detecting malicious sessions through traffic fingerprinting using hidden markov models

Abstract

Publication series

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Fingerprint

Cite this