Filtering Automated Polling Traffic in Computer Network Flow Data

摘要: Detecting polling behaviour in a computer network has two important applications. First, the can be indicative of malware beaconing, where an undetected software virus sends regular communications to controller. Second, cause may not malicious, since it correspond automated update requests permitted by client, build models normal host for signature-free anomaly detection, this needs understood. This article presents simple Fourier analysis technique identifying polling, and focuses on second application: modelling host, using real data collected from Imperial College London.