Behavioral‐based feature abstraction from network traffic
Document Type
Conference Proceeding
Publication Title
Proceedings of the 10th International Conference on Cyber Warfare and Security
Publisher
Academic Conferences and Publishing International Ltd
School
School of Science / Security Research Institute
RAS ID
20182
Abstract
Information security breaches cost organizations collectively billions in lost intellectual property and business. To mitigate this threat, a whole host of countermeasures have been devised to detect, monitor and respond to network‐based attacks and compromise. These include: incident management teams oper‐ating 24/7, network forensic tools, Security Incident and Event Management (SIEM) systems, insider misuse detection, intrusion detection and intrusion pre‐vention systems. A fundamental limitation of all these approaches however is the reliance upon analyzing network traffic based upon the computer node, which itself is derived from a dynamically allocated IP address, rather than being able to identify network traffic based upon the user. Identifying the user rather than IP provides a more complete and accurate set of data to be utilized within existing countermeasures. For example, in an organization, a user might have access to a desktop, laptop, tablet and mobile phone that all utilize and access the corporate network and who’s IPs are different and vary against time. Currently understand‐ing and identifying that user in such an environment is extremely challenging and time consuming. Whilst research has attempted to achieve this level of abstrac‐tion to the user, results are poor due to the volume and variability of data at the network‐level. This paper describes a research study into the identification and extraction of high‐level behavioural features from low‐level network traffic. Hav‐ing identified application‐level services and derived sets of typical use cases, this research presents a set of experiments to demonstrate how user behaviours with‐in internet‐enabled applications can be determined through analysis of low‐level network traffic metadata. The enhanced features that are derived not only inform us of which services a person is using but also how they use it. For example, from our social networking experiment it has been shown that it is possible to identify whether a person is reading, posting an image or using instant messenger. This feature‐rich user‐focused approach to metadata analysis of network traffic will provide the underlying information required for profiling and modelling user activity.
Access Rights
subscription content
Comments
Alotibi, G., Li, F., Clarke, N., & Furnell, S. (2015). Behavioral‐Based Feature Abstraction From Network Traffic . In Proceedings of the 10th International Conference on Cyber Warfare and Security (pp. 1-9). Reading, England: Academic Conferences and Publishing International. Available here