Detect Malicious Attacks from Entire TCP Communication Process

摘要: Malicious attack identification plays an essential role in network security monitoring. Current popular technologies are mainly to select a closely related set of attributes from packet header for fingerprinting malicious attacks. Those methods not effective enough because attacks can be disguised as normal applications and we cannot observe their characteristics only the packer’s header. In this paper, will employ generated entire TCP communication process identify A challenging point our method is how choose right up 248 properties flows low proportion wide variety real-world viruses analyzed samples, such extortion virus WannaCry. The experiment results demonstrate that proposed fingerprint but also accurately types virus.