NeTs-NBD: Maltraffic Analysis and Detection in Challenging and Aggregate Traffic (MADCAT)

如今，许多被破坏的计算机都会产生恶意通信，例如拒绝服务（DoS）攻击、间谍软件报告、未经授权的应用程序、垃圾邮件和蠕虫。目前的防御正变得越来越脆弱。造成这一挑战的原因有以下几个：加密限制了对数据包内容的检查，网络边缘的聚合限制了过滤和黑名单的使用，因为有潜在的附带损害，增加的流量允许隐藏恶意流量，应用程序通常通过分层协议（HTTP上的SOAP或不同的端口分配）或主动隐藏来隐藏。该方案将信号处理和检测理论应用于网络流量中，以检测这些具有挑战性的场景中的恶意流量。我们将使用数据包定时和频率等特征，仔细设计测量和检测系统，以及研究协议中的固有行为来应对这些挑战。更广泛的影响：这项工作的结果将包括(a)开发一种系统的方法，将信号处理方法应用于网络流量；(b)分析针对不当通讯的新信号表示和检测方法；(c)识别、理解和建模不良流量的关键识别特征和固有行为，以及它们是如何被网络塑造的。我们的新方法将对网络流量产生更深入的理解，并将通过真实网络流量的痕迹进行测试，从而产生解决这些问题的新工具。

Many compromised computers today generate maltraffic, such as denial-of-service (DoS) attacks, spyware reporting home, unauthorized applications, spam, and worms. Current defenses are becoming increasingly brittle. There are several reasons for this challenge: encryption limits packet content inspecting, aggregation at network edge limits use of filtering and blacklisting due to potential collateral damage, increased traffic volumes allow maltraffic to hide, and applications are often cloaked through layered protocols (SOAP over HTTP or varying port allocation) or active concealment.This proposal applies signal processing and detection theory to network traffic to detect maltraffic in these challenging scenarios. We will use features such as packet timing and frequency, careful design of the measurement and detection systems, and study of inherent behaviors in protocols to address these challenges.Broader Impact: The results of this work will include (a) the development of a systematic methodology for applying signal processing methods to network traffic; (b) the analysis of new signal representation and detection methods specific to maltraffic; and (c) the identification, understanding, and modeling of key identifying features and inherent behaviors of maltraffic and how they are shaped by the network. Our new approaches will yield a deeper understanding of network traffic, and will be tested with traces of real network traffic, resulting in new tools to combat these problems.