Identifying compromised systems through correlation of suspicious traffic from malware behavioral analysis

Ana E. F. Camilo; André Grégio; Rafael D. C. Santos

doi:10.1117/12.2223968

12 May 2016 Identifying compromised systems through correlation of suspicious traffic from malware behavioral analysis

Ana E. F. Camilo, André Grégio, Rafael D. C. Santos

Proceedings Volume 9826, Cyber Sensing 2016; 982606 (2016) https://doi.org/10.1117/12.2223968
Event: SPIE Defense + Security, 2016, Baltimore, MD, United States

Abstract

Malware detection may be accomplished through the analysis of their infection behavior. To do so, dynamic analysis systems run malware samples and extract their operating system activities and network traffic. This traffic may represent malware accessing external systems, either to steal sensitive data from victims or to fetch other malicious artifacts (configuration files, additional modules, commands). In this work, we propose the use of visualization as a tool to identify compromised systems based on correlating malware communications in the form of graphs and finding isomorphisms between them. We produced graphs from over 6 thousand distinct network traffic files captured during malware execution and analyzed the existing relationships among malware samples and IP addresses.

Citation Download Citation

Ana E. F. Camilo, André Grégio, and Rafael D. C. Santos "Identifying compromised systems through correlation of suspicious traffic from malware behavioral analysis", Proc. SPIE 9826, Cyber Sensing 2016, 982606 (12 May 2016); https://doi.org/10.1117/12.2223968

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available