Behavioral Service Graphs

摘要: The task of generating network-based evidence to support network forensic investigation is becoming increasingly prominent. Undoubtedly, such significantly imperative as it not only can be used diagnose and respond various network-related issues (i.e., performance bottlenecks, routing issues, etc.) but more importantly, leveraged infer further investigate security intrusions infections. In this context, paper proposes a proactive approach that aims at accurate actionable related groups compromised machines campaigns). envisioned guide investigators promptly pinpoint malicious for possible immediate mitigation well empowering digital specialists examine those using auxiliary collected data or extracted artifacts. On one hand, the promptness successfully achieved by monitoring correlating perceived probing activities, which are typically very first signs an infection misdemeanors. other generated based on anomaly inference fuses behavioral analytics in conjunction with formal graph theoretic concepts. We evaluate proposed two deployment scenarios, namely, enterprise edge engine global capability operations center model. empirical evaluation employs 10GB real botnet traffic 80GB darknet indeed demonstrates accuracy, effectiveness simplicity evidence.