NeTs-NBD: Maltraffic Analysis and Detection in Challenging and Aggregate Traffic (MADCAT)

如今，许多受危害的计算机会产生恶意流量，例如拒绝服务(DoS)攻击、间谍软件报告总部、未经授权的应用程序、垃圾邮件和蠕虫。目前的防御措施正变得越来越脆弱。这一挑战有几个原因：加密限制了数据包内容检测，网络边缘聚合限制了过滤和黑名单的使用，因为潜在的附带损害，增加的通信量允许隐藏错误流量，应用程序通常通过分层协议(HTTP上的SOAP或变化的端口分配)或主动隐藏来掩盖。该建议将信号处理和检测理论应用于网络流量，以在这些具有挑战性的场景中检测错误流量。我们将使用数据包定时和频率、测量和检测系统的仔细设计以及对协议中固有行为的研究等功能来应对这些挑战。广泛影响：这项工作的结果将包括：(A)开发将信号处理方法应用于网络流量的系统方法；(B)分析针对流量异常的新信号表示和检测方法；以及(C)识别、理解和建模流量异常的关键识别特征和内在行为，以及它们是如何由网络塑造的。我们的新方法将产生对网络流量的更深层次的了解，并将通过实际网络流量的痕迹进行测试，从而产生解决这些问题的新工具。

Many compromised computers today generate maltraffic, such as denial-of-service (DoS) attacks, spyware reporting home, unauthorized applications, spam, and worms. Current defenses are becoming increasingly brittle. There are several reasons for this challenge: encryption limits packet content inspecting, aggregation at network edge limits use of filtering and blacklisting due to potential collateral damage, increased traffic volumes allow maltraffic to hide, and applications are often cloaked through layered protocols (SOAP over HTTP or varying port allocation) or active concealment.This proposal applies signal processing and detection theory to network traffic to detect maltraffic in these challenging scenarios. We will use features such as packet timing and frequency, careful design of the measurement and detection systems, and study of inherent behaviors in protocols to address these challenges.Broader Impact: The results of this work will include (a) the development of a systematic methodology for applying signal processing methods to network traffic; (b) the analysis of new signal representation and detection methods specific to maltraffic; and (c) the identification, understanding, and modeling of key identifying features and inherent behaviors of maltraffic and how they are shaped by the network. Our new approaches will yield a deeper understanding of network traffic, and will be tested with traces of real network traffic, resulting in new tools to combat these problems.