IEICE TRANSACTIONS on Information
Real-Time Detection of Global Cyberthreat Based on Darknet by Estimating Anomalous Synchronization Using Graphical Lasso
Summary :
With the rapid evolution and increase of cyberthreats in recent years, it is necessary to detect and understand it promptly and precisely to reduce the impact of cyberthreats. A darknet, which is an unused IP address space, has a high signal-to-noise ratio, so it is easier to understand the global tendency of malicious traffic in cyberspace than other observation networks. In this paper, we aim to capture global cyberthreats in real time. Since multiple hosts infected with similar malware tend to perform similar behavior, we propose a system that estimates a degree of synchronizations from the patterns of packet transmission time among the source hosts observed in unit time of the darknet and detects anomalies in real time. In our evaluation, we perform our proof-of-concept implementation of the proposed engine to demonstrate its feasibility and effectiveness, and we detect cyberthreats with an accuracy of 97.14%. This work is the first practical trial that detects cyberthreats from in-the-wild darknet traffic regardless of new types and variants in real time, and it quantitatively evaluates the result.
- Publication
- IEICE TRANSACTIONS on Information Vol.E103-D No.10 pp.2113-2124
- Publication Date
- 2020/10/01
- Publicized
- 2020/06/25
- Online ISSN
- 1745-1361
- DOI
- 10.1587/transinf.2020EDP7076
- Type of Manuscript
- PAPER
- Category
- Information Network
Authors
Chansu HAN
National Institute of Information and Communications Technology,Kyushu University
Jumpei SHIMAMURA
clwit Inc.
Takeshi TAKAHASHI
National Institute of Information and Communications Technology
Daisuke INOUE
National Institute of Information and Communications Technology
Jun'ichi TAKEUCHI
Kyushu University
Koji NAKAO
National Institute of Information and Communications Technology
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Chansu HAN, Jumpei SHIMAMURA, Takeshi TAKAHASHI, Daisuke INOUE, Jun'ichi TAKEUCHI, Koji NAKAO, "Real-Time Detection of Global Cyberthreat Based on Darknet by Estimating Anomalous Synchronization Using Graphical Lasso" in IEICE TRANSACTIONS on Information,
vol. E103-D, no. 10, pp. 2113-2124, October 2020, doi: 10.1587/transinf.2020EDP7076.
Abstract: With the rapid evolution and increase of cyberthreats in recent years, it is necessary to detect and understand it promptly and precisely to reduce the impact of cyberthreats. A darknet, which is an unused IP address space, has a high signal-to-noise ratio, so it is easier to understand the global tendency of malicious traffic in cyberspace than other observation networks. In this paper, we aim to capture global cyberthreats in real time. Since multiple hosts infected with similar malware tend to perform similar behavior, we propose a system that estimates a degree of synchronizations from the patterns of packet transmission time among the source hosts observed in unit time of the darknet and detects anomalies in real time. In our evaluation, we perform our proof-of-concept implementation of the proposed engine to demonstrate its feasibility and effectiveness, and we detect cyberthreats with an accuracy of 97.14%. This work is the first practical trial that detects cyberthreats from in-the-wild darknet traffic regardless of new types and variants in real time, and it quantitatively evaluates the result.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.2020EDP7076/_p
Copy
@ARTICLE{e103-d_10_2113,
author={Chansu HAN, Jumpei SHIMAMURA, Takeshi TAKAHASHI, Daisuke INOUE, Jun'ichi TAKEUCHI, Koji NAKAO, },
journal={IEICE TRANSACTIONS on Information},
title={Real-Time Detection of Global Cyberthreat Based on Darknet by Estimating Anomalous Synchronization Using Graphical Lasso},
year={2020},
volume={E103-D},
number={10},
pages={2113-2124},
abstract={With the rapid evolution and increase of cyberthreats in recent years, it is necessary to detect and understand it promptly and precisely to reduce the impact of cyberthreats. A darknet, which is an unused IP address space, has a high signal-to-noise ratio, so it is easier to understand the global tendency of malicious traffic in cyberspace than other observation networks. In this paper, we aim to capture global cyberthreats in real time. Since multiple hosts infected with similar malware tend to perform similar behavior, we propose a system that estimates a degree of synchronizations from the patterns of packet transmission time among the source hosts observed in unit time of the darknet and detects anomalies in real time. In our evaluation, we perform our proof-of-concept implementation of the proposed engine to demonstrate its feasibility and effectiveness, and we detect cyberthreats with an accuracy of 97.14%. This work is the first practical trial that detects cyberthreats from in-the-wild darknet traffic regardless of new types and variants in real time, and it quantitatively evaluates the result.},
keywords={},
doi={10.1587/transinf.2020EDP7076},
ISSN={1745-1361},
month={October},}
Copy
TY - JOUR
TI - Real-Time Detection of Global Cyberthreat Based on Darknet by Estimating Anomalous Synchronization Using Graphical Lasso
T2 - IEICE TRANSACTIONS on Information
SP - 2113
EP - 2124
AU - Chansu HAN
AU - Jumpei SHIMAMURA
AU - Takeshi TAKAHASHI
AU - Daisuke INOUE
AU - Jun'ichi TAKEUCHI
AU - Koji NAKAO
PY - 2020
DO - 10.1587/transinf.2020EDP7076
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E103-D
IS - 10
JA - IEICE TRANSACTIONS on Information
Y1 - October 2020
AB - With the rapid evolution and increase of cyberthreats in recent years, it is necessary to detect and understand it promptly and precisely to reduce the impact of cyberthreats. A darknet, which is an unused IP address space, has a high signal-to-noise ratio, so it is easier to understand the global tendency of malicious traffic in cyberspace than other observation networks. In this paper, we aim to capture global cyberthreats in real time. Since multiple hosts infected with similar malware tend to perform similar behavior, we propose a system that estimates a degree of synchronizations from the patterns of packet transmission time among the source hosts observed in unit time of the darknet and detects anomalies in real time. In our evaluation, we perform our proof-of-concept implementation of the proposed engine to demonstrate its feasibility and effectiveness, and we detect cyberthreats with an accuracy of 97.14%. This work is the first practical trial that detects cyberthreats from in-the-wild darknet traffic regardless of new types and variants in real time, and it quantitatively evaluates the result.
ER -
English
