NDLI: Discriminative Models for Multi-instance Problems with Tree Structure

Please wait, while we are loading the content...

SherLock vs Moriarty: A Smartphone Dataset for Cybersecurity Research

DeepDGA: Adversarially-Tuned Domain Generation and Detection

Secure Kernel Machines against Evasion Attacks

True Friends Let You Down: Benchmarking Social Graph Anonymization Schemes

Tracked Without a Trace: Linking Sessions of Users by Unsupervised Learning of Patterns in Their DNS Traffic

Prescience: Probabilistic Guidance on the Retraining Conundrum for Malware Detection

Change of Guard: The Next Generation of Social Graph De-anonymization Attacks

Identifying Encrypted Malware Traffic with Contextual Flow Data

Discriminative Models for Multi-instance Problems with Tree Structure

Differentially Private Online Active Learning with Applications to Anomaly Detection

Causality-based Sensemaking of Network Traffic for Android Application Security

A Dual Perturbation Approach for Differential Private ADMM-Based Distributed Empirical Risk Minimization

Discriminative Models for Multi-instance Problems with Tree Structure

Content Provider	ACM Digital Library
Author	Pevny, Tomas Somol, Petr
Abstract	Modelling network traffic is gaining importance to counter modern security threats of ever increasing sophistication. It is though surprisingly difficult and costly to construct reliable classifiers on top of telemetry data due to the variety and complexity of signals that no human can manage to interpret in full. Obtaining training data with sufficiently large and variable body of labels can thus be seen as a prohibitive problem. The goal of this work is to detect infected computers by observing their HTTP(S) traffic collected from network sensors, which are typically proxy servers or network firewalls, while relying on only minimal human input in the model training phase. We propose a discriminative model that makes decisions based on a computer's all traffic observed during a predefined time window (5 minutes in our case). The model is trained on traffic samples collected over equally-sized time windows for a large number of computers, where the only labels needed are (human) verdicts about the computer as a whole (presumed infected vs. presumed clean). As part of training, the model itself learns discriminative patterns in traffic targeted to individual servers and constructs the final high-level classifier on top of them. We show the classifier to perform with very high precision, and demonstrate that the learned traffic patterns can be interpreted as Indicators of Compromise. We implement the discriminative model as a neural network with special structure reflecting two stacked multi instance problems. The main advantages of the proposed configuration include not only improved accuracy and ability to learn from gross labels, but also automatic learning of server types (together with their detectors) that are typically visited by infected computers.
Starting Page	83
Ending Page	91
Page Count	9
File Format	PDF
ISBN	9781450345736
DOI	10.1145/2996758.2996761
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2016-10-28
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Learning indicators of compromise Big data Neural network User modeling Malware detection
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in