NDLI: Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Content Provider	IEEE Xplore Digital Library
Author	Oprea, A. Zhou Li Ting-Fang Yen Chin, S.H. Alrwais, S.
Copyright Year	2015
Description	Author affiliation: RSA Labs., Cambridge, MA, USA (Oprea, A.; Zhou Li) \|\| E8 Security, Palo Alto, CA, USA (Ting-Fang Yen) \|\| Indiana Univ., Bloomington, IN, USA (Alrwais, S.) \|\| Draper Lab., Cambridge, MA, USA (Chin, S.H.)
Abstract	Recent years have seen the rise of sophisticated attacks including advanced persistent threats (APT) which pose severe risks to organizations and governments. Additionally, new malware strains appear at a higher rate than ever before. Since many of these malware evade existing security products, traditional defenses deployed by enterprises today often fail at detecting infections at an early stage. We address the problem of detecting early-stage APT infection by proposing a new framework based on belief propagation inspired from graph theory. We demonstrate that our techniques perform well on two large datasets. We achieve high accuracy on two months of DNS logs released by Los Alamos National Lab (LANL), which include APT infection attacks simulated by LANL domain experts. We also apply our algorithms to 38TB of web proxy logs collected at the border of a large enterprise and identify hundreds of malicious domains overlooked by state-of-the-art security products.
Starting Page	45
Ending Page	56
File Size	383422
Page Count	12
File Format	PDF
e-ISBN	9781479986293
DOI	10.1109/DSN.2015.14
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-06-22
Publisher Place	Brazil
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Belief propagation Malware System-on-chip Electronic mail IP networks Servers Belief Propagation Advanced Persistent Threats Data Analysis
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

1 Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Ctracer: Uncover C&C in Advanced Persistent Threats Based on Scalable Framework for Enterprise Log Data

Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Advanced Persistent Threats - detection and defense

Guilt by association: large scale malware detection by mining file-relation graphs

Blacklist-based malicious IP traffic detection

Asset Risk Scoring in Enterprise Network with Mutually Reinforced Reputation Propagation

Breach detection system testing methodology

Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Similar Documents

1 Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Ctracer: Uncover C&C in Advanced Persistent Threats Based on Scalable Framework for Enterprise Log Data

Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

Advanced Persistent Threats - detection and defense

Guilt by association: large scale malware detection by mining file-relation graphs

Blacklist-based malicious IP traffic detection

Asset Risk Scoring in Enterprise Network with Mutually Reinforced Reputation Propagation

Breach detection system testing methodology

Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data