Optimized Invariant Representation of Network Traffic for Detecting Unseen...
summary
System learns an invariant bag-level representation over proxy log records by computing per-feature histograms plus a self-similarity matrix of flow sequences, then automatically merges hundreds of tiny bins into learned histogram bins optimized for classification. Deployed on corporate traffic, it flags 2,090 previously unseen variants with ~90% precision and shows ~67% recall on entirely new malware categories. It fails on single-flow/static bags, mixed-behavior bags and currently does not handle HTTPS payloads.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:27Motivation - Network Security Challenges
- 1:14Malicious Traffic and HTTP(S)
- 1:50Our Goal
- 2:38Input data - proxy log records
- 3:13Flows are Grouped into Bags
- 3:36Malware Bags
- 5:42Malware Changes - Example
- 6:59High Variability of Flow-based Features
- 8:00Histogram
- 8:31What is better?
- 12:32Overview
- 13:56Not invariant to the following changes
- 15:23Parameters of the Representation
- 16:18Proposed Optimization Algorithm
- 17:34Experiments - Dataset Description
- 18:24Experiments - 2D projection (t-SNE)
- 19:32Learning bins from 256 equidistant mini-bins
- 20:35Optimizing Decision Boundary
- 21:14Efficacy Results - Unseen Malware
- 22:57Conclusion and Future Work
related talks
50mDeep Impact: Recognizing Unknown Malicious Activities from Zero Knowledge
17mNetVigil: Robust and Low-Cost Anomaly Detection for East-West Data Center Security
35mNo labels? No problem!
17mPrivateEye: Scalable and Privacy Preserving Compromise Detection in the Cloud
47m Natural Language Processing & Anomaly detection in Sys call logs
46mHow to detect Malware in Encrypted Traffic Without Decryption
40mHow to Map Networked Devices Using Graph-Based AI to Preempt Cyber Threats
32mSecure And Scalable Anomaly-Based Network Intrusion Detection