Detecting malicious clients in ISP networks using HTTP connectivity graph and flow information

摘要: This paper considers an approach to identify previously undetected malicious clients in Internet Service Provider (ISP) networks by combining flow classification with a graph-based score propagation method. Our represents all HTTP communications between and servers as weighted, near-bipartite graph, where the nodes correspond IP addresses of while links are their interconnections, weighted according output flow-based classifier. We employ two-phase alternating algorithm on graph suspicious monitored network. Using symmetrized adjacency matrix its input, we show that our is less vulnerable towards inflating scores popular Web high in-degrees compared normalization used PageRank, widely Experimental results 4-hour network trace collected large service provider showed incorporating information into significantly improves precision algorithm.