Using Failure Information Analysis to Detect Enterprise Zombies [chapter]

Zhaosheng Zhu, Vinod Yegneswaran, Yan Chen
2009 Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering  
We propose failure information analysis as a novel strategy for uncovering malware activity and other anomalies in enterprise network traffic. A focus of our study is detecting self-propagating malware such as worms and botnets. We begin by conducting an empirical study of transport-and application-layer failure activity using a collection of long-lived malware traces. We dissect the failure activity observed in this traffic in several dimensions, finding that their failure patterns differ
more » ... ficantly from those of real-world applications. Based on these observations, we describe the design of a prototype system called Netfuse to automatically detect and isolate malware-like failure patterns. The system uses an SVM-based classification engine to identify suspicious systems and clustering to aggregate failure activity of related enterprise hosts. Our evaluation using several malware traces demonstrates that the Netfuse system provides an effective means to discover suspicious application failures and infected enterprise hosts. We believe it would be a useful complement to existing defenses.
doi:10.1007/978-3-642-05284-2_11 fatcat:2klhpaekdbftvgjrqrl4rwnmte