NDLI: EMBER: a global perspective on extreme malicious behavior

Please wait, while we are loading the content...

EMBER: a global perspective on extreme malicious behavior

Proposing a multi-touch interface for intrusion detection environments

Visualizing attack graphs, reachability, and trust relationships with NAVIGATOR

Visualizing graph dynamics and similarity for enterprise network security and management

Visual analysis of code security

PeekKernelFlows: peeking into IP flows

Visualizing host traffic through graphs

Visualizing your key for secure phone calls and language independence

Traffic classification using visual motifs: an empirical evaluation

Real-time visualization of network behaviors for situational awareness

Interactive detection of network anomalies via coordinated multiple views

Nimble cybersecurity incident management through visualization and defensible recommendations

EMBER: a global perspective on extreme malicious behavior

Content Provider	ACM Digital Library
Author	Boyer, Stephen Lippmann, Richard Yu, Tamara Riordan, James
Abstract	Geographical displays are commonly used for visualizing wide-spread malicious behavior of Internet hosts. Placing dots on a world map or coloring regions by the magnitude of activity often results in cluttered maps that invariably emphasize population-dense metropolitan areas in developed countries where Internet connectivity is highest. To uncover atypical regions, it is necessary to normalize activity by the local computer population. This paper presents EMBER (Extreme Malicious Behavior viewER), an analysis and display of malicious activity at the city level. EMBER uses a metric called Standardized Incidence Rate (SIR) that is the number of hosts exhibiting malicious behavior per 100,000 available hosts. This metric relies on available data that (1) Maps IP addresses to geographic locations, (2) Provides current city populations, and (3) Provides computer usage penetration rates. Analysis of several months of suspicious source IP addresses from DShield identifies cities with extremely high and low malicious activity rates on a day-by-day basis. In general, cities in a few Eastern European countries have the highest SIRs whereas cities in Japan and South Korea have the lowest. Many of these results are consistent with news reports describing local cyber security policies. A simulation that models how malware spreads preferentially within cities to local IP addresses replicates the long-tailed distribution of city SIRs that was found in the data. This simulation result agrees with past analyses in suggesting that malware often preferentially spreads to local regions with already high levels of malicious activity.
Starting Page	1
Ending Page	12
Page Count	12
File Format	PDF
ISBN	9781450300131
DOI	10.1145/1850795.1850796
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-09-14
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Situational awareness Visualization City infection rate Computer network attacks Normalized metric World map Malware Long-tail distribution
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in