Ryo Nakamura, Y. Sekiya, Daisuke Miyamoto, Kazuya Okada, Tomohiro Ishihara
{"title":"基于SYN报文成像和神经网络的恶意主机检测","authors":"Ryo Nakamura, Y. Sekiya, Daisuke Miyamoto, Kazuya Okada, Tomohiro Ishihara","doi":"10.1109/ISNCC.2018.8530964","DOIUrl":null,"url":null,"abstract":"As is the case for recently networked systems, traffic analysis that detects malicious hosts is one of the most important issues in achieving better security. Many methods for detecting cyber attacks have been proposed; however, methods that specialize in detecting and identifying specific attacks will be obsolete in the near future. Instead of identifying types of cyber attacks, we propose a novel method to detect malicious hosts based on their behavior characteristics when they send SYN packets. Our method does not identify types of cyber attacks. It detects malicious hosts suspiciously sending SYN packets. This paper shows that (1) we have developed a method to convert a series of SYN packets to a visual image as input for neural networks, (2) the image represents distinctive features of the behavior of the hosts, and (3) our convolutional neural network model successfully distinguishes malicious host from normal ones. Our preliminary evaluation using real-word traffic shows that the detection accuracy for identifying malicious hosts is over 98% regardless of types of attack.","PeriodicalId":313846,"journal":{"name":"2018 International Symposium on Networks, Computers and Communications (ISNCC)","volume":null,"pages":null},"PeriodicalIF":0.0000,"publicationDate":"2018-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"5","resultStr":"{\"title\":\"Malicious Host Detection by Imaging SYN Packets and A Neural Network\",\"authors\":\"Ryo Nakamura, Y. Sekiya, Daisuke Miyamoto, Kazuya Okada, Tomohiro Ishihara\",\"doi\":\"10.1109/ISNCC.2018.8530964\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"As is the case for recently networked systems, traffic analysis that detects malicious hosts is one of the most important issues in achieving better security. Many methods for detecting cyber attacks have been proposed; however, methods that specialize in detecting and identifying specific attacks will be obsolete in the near future. Instead of identifying types of cyber attacks, we propose a novel method to detect malicious hosts based on their behavior characteristics when they send SYN packets. Our method does not identify types of cyber attacks. It detects malicious hosts suspiciously sending SYN packets. This paper shows that (1) we have developed a method to convert a series of SYN packets to a visual image as input for neural networks, (2) the image represents distinctive features of the behavior of the hosts, and (3) our convolutional neural network model successfully distinguishes malicious host from normal ones. Our preliminary evaluation using real-word traffic shows that the detection accuracy for identifying malicious hosts is over 98% regardless of types of attack.\",\"PeriodicalId\":313846,\"journal\":{\"name\":\"2018 International Symposium on Networks, Computers and Communications (ISNCC)\",\"volume\":null,\"pages\":null},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2018-06-01\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"5\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"2018 International Symposium on Networks, Computers and Communications (ISNCC)\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1109/ISNCC.2018.8530964\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"2018 International Symposium on Networks, Computers and Communications (ISNCC)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/ISNCC.2018.8530964","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
Malicious Host Detection by Imaging SYN Packets and A Neural Network
As is the case for recently networked systems, traffic analysis that detects malicious hosts is one of the most important issues in achieving better security. Many methods for detecting cyber attacks have been proposed; however, methods that specialize in detecting and identifying specific attacks will be obsolete in the near future. Instead of identifying types of cyber attacks, we propose a novel method to detect malicious hosts based on their behavior characteristics when they send SYN packets. Our method does not identify types of cyber attacks. It detects malicious hosts suspiciously sending SYN packets. This paper shows that (1) we have developed a method to convert a series of SYN packets to a visual image as input for neural networks, (2) the image represents distinctive features of the behavior of the hosts, and (3) our convolutional neural network model successfully distinguishes malicious host from normal ones. Our preliminary evaluation using real-word traffic shows that the detection accuracy for identifying malicious hosts is over 98% regardless of types of attack.