Behavioral Service Graphs: A Big Data Approach for Prompt Investigation of Internet-Wide Infections

摘要: The task of generating network-based evidence to support network forensic investigation is becoming increasingly prominent. Undoubtedly, such significantly imperative as it not only can be used diagnose and respond various network-related issues (i.e., performance bottlenecks, routing issues, etc.) but more importantly, leveraged infer further investigate security intrusions infections. In this context, paper proposes a proactive approach that aims at accurate actionable related groups compromised machines. envisioned guide investigators promptly pinpoint malicious for possible immediate mitigation well empowering digital specialists examine those machines using auxiliary collected data or extracted artifacts. On one hand, the promptness successfully achieved by monitoring correlating perceived probing activities, which are typically very first signs an infection misdemeanors. other generated based on anomaly inference fuses big behavioral analytics in conjunction with formal graph theoretical concepts. We evaluate proposed global capability operations center. empirical evaluations, employ 80 GB real darknet traffic, indeed demonstrates accuracy, effectiveness simplicity evidence.