Is Host-Based Anomaly Detection + Temporal Correlation = Worm Causality

摘要: Abstract : Epidemic-spreading attacks (e.g., worm and botnet propagation) have a natural notion of attack causality - single network flow causes victim host to get infected subsequently spread the attack. This paper is motivated by simple question regarding diagnosis such it possible establish attack-causality through network-level monitoring, without relying on signatures attack-specific properties? Using observation that communication patterns normal hosts are sparse, we posit hypothesis feasible uncover combination host-based anomaly detection temporal correlation events. The contribution this systematic exploration over spectrum properties system design options. Our analysis, trace-driven experiments, real prototype based study suggest accurately using event in enterprise environments with tens thousands hosts.