Real-time detection of malicious network activity using stochastic models
Thesis (Ph. D.)--Massachusetts Institute of Technology, Dept. of Electrical Engineering and Computer Science, 2006.
| Main Author: | |
|---|---|
| Other Authors: | |
| Format: | Thesis |
| Language: | eng |
| Published: |
Massachusetts Institute of Technology
2007
|
| Subjects: | |
| Online Access: | http://hdl.handle.net/1721.1/37892 |
| _version_ | 1826212135664877568 |
|---|---|
| author | Jung, Jaeyeon, Ph. D. Massachusetts Institute of Technology |
| author2 | Hari Balakrishnan. |
| author_facet | Hari Balakrishnan. Jung, Jaeyeon, Ph. D. Massachusetts Institute of Technology |
| author_sort | Jung, Jaeyeon, Ph. D. Massachusetts Institute of Technology |
| collection | MIT |
| description | Thesis (Ph. D.)--Massachusetts Institute of Technology, Dept. of Electrical Engineering and Computer Science, 2006. |
| first_indexed | 2024-09-23T15:16:57Z |
| format | Thesis |
| id | mit-1721.1/37892 |
| institution | Massachusetts Institute of Technology |
| language | eng |
| last_indexed | 2024-09-23T15:16:57Z |
| publishDate | 2007 |
| publisher | Massachusetts Institute of Technology |
| record_format | dspace |
| spelling | mit-1721.1/378922019-04-10T12:50:30Z Real-time detection of malicious network activity using stochastic models Jung, Jaeyeon, Ph. D. Massachusetts Institute of Technology Hari Balakrishnan. Massachusetts Institute of Technology. Dept. of Electrical Engineering and Computer Science. Massachusetts Institute of Technology. Dept. of Electrical Engineering and Computer Science. Electrical Engineering and Computer Science. Thesis (Ph. D.)--Massachusetts Institute of Technology, Dept. of Electrical Engineering and Computer Science, 2006. Includes bibliographical references (p. 115-122). This dissertation develops approaches to rapidly detect malicious network traffic including packets sent by portscanners and network worms. The main hypothesis is that stochastic models capturing a host's particular connection-level behavior provide a good foundation for identifying malicious network activity in real-time. Using the models, the dissertation shows that a detection problem can be formulated as one of observing a particular "trajectory" of arriving packets and inferring from it the most likely classification for the given host's behavior. This stochastic approach enables us not only to estimate an algorithm's performance based on the measurable statistics of a host's traffic but also to balance the goals of promptness and accuracy in detecting malicious network activity. This dissertation presents three detection algorithms based on Wald's mathematical framework of sequential analysis. First, Threshold Random Walk (TRW) rapidly detects remote hosts performing a portscan to a target network. TRW is motivated by the empirically observed disparity between the frequency with which connections to newly visited local addresses are successful for benign hosts vs. for portscanners. Second, it presents a hybrid approach that accurately detects scanning worm infections quickly after the infected local host begins to engage in worm propagation. (cont.) Finally, it presents a targeting worm detection algorithm, Rate-Based Sequential Hypothesis Testing (RBS), that promptly identifies high-fan-out behavior by hosts (e.g., targeting worms) based on the rate at which the hosts initiate connections to new destinations. RBS is built on an empirically-driven probability model that captures benign network characteristics. It then presents RBS+TRW, a unified framework for detecting fast-propagating worms independently of their target discovery strategy. All these schemes have been implemented and evaluated using real packet traces collected from multiple network vantage points. by Jaeyeon Jung. Ph.D. 2007-07-18T13:05:10Z 2007-07-18T13:05:10Z 2006 2006 Thesis http://hdl.handle.net/1721.1/37892 131325073 eng M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission. http://dspace.mit.edu/handle/1721.1/7582 122 p. application/pdf Massachusetts Institute of Technology |
| spellingShingle | Electrical Engineering and Computer Science. Jung, Jaeyeon, Ph. D. Massachusetts Institute of Technology Real-time detection of malicious network activity using stochastic models |
| title | Real-time detection of malicious network activity using stochastic models |
| title_full | Real-time detection of malicious network activity using stochastic models |
| title_fullStr | Real-time detection of malicious network activity using stochastic models |
| title_full_unstemmed | Real-time detection of malicious network activity using stochastic models |
| title_short | Real-time detection of malicious network activity using stochastic models |
| title_sort | real time detection of malicious network activity using stochastic models |
| topic | Electrical Engineering and Computer Science. |
| url | http://hdl.handle.net/1721.1/37892 |
| work_keys_str_mv | AT jungjaeyeonphdmassachusettsinstituteoftechnology realtimedetectionofmaliciousnetworkactivityusingstochasticmodels |