Peer Based Tracking using Multi-Tuple Indexing for Network Traffic Analysis and Malware Detection

摘要: Traditional firewalls, Intrusion Detection Systems(IDS) and network analytics tools extensively use the ‘flow’ connection concept, consisting of five ‘tuples’ source destination IP, ports protocol type, for classification management activities. By analysing flows, information can be obtained from TCP/IP fields packet content to give an understanding what is being transferred within a single connection. As networks have evolved incorporate more connections greater bandwidth, particularly “always on” IoT devices video data streaming, so too malicious threats, whose communication methods increased in sophistication. result, concept 5 tuple flow isolation unable detect such threats behaviours. This due factors as length time required understand traffic behaviour, which cannot accomplished by observing To alleviate this issue, paper proposes additional, two types associate multiple communications, with generated metadata used profile individual connnection behaviour. proposed approach enables advanced linking different behaviours, developing clearer picture activities been taking place over prolonged period time. demonstrate capability approach, expert system rule set has developed presence multi-peered ZeuS botnet, communicates making hosts, thus undetectable standard IDS systems isolation. Finally, solution based, implementation operates realtime does not require post-processing other research solutions. aims possible applications next generation firewalls acquire additional traffic.