Transport traffic analysis for abusive infrastructure characterization
Loading...
Authors
Nolan, Le
Beverly, Robert
Xie, Geoffrey
Subjects
Advisors
Date of Issue
2012-12
Date
Publisher
Monterey, California : Naval Postgraduate School
Language
en_US
Abstract
We investigate a promising approach that identifies discriminating features of likely communications involving abusive hosts from per-packet TCP header and timing information. These features identify congestion, flow-control, and other low-level network and system characteristics indicative of an abusive network host. Our approach is IP address and content agnostic, and therefore privacy-preserving to permit wider deployment than previously possible. Importantly, the modeled characteristics are inherent to the poorly connected, under-provisioned, low-end, and overloaded hosts or links typical of abusive infrastructure making them difficult for an adversary to manipulate. In contrast to existing network-centric approaches reliant on flow-level records, fine-grained per-packet features yield superior performance with negligible processing impact. On real-world traces from accessing 40,000 Alexa and 30,000 known-abusive web sites, we achieve a classification accuracy of 94% with a 3% false positive rate using only transport features.
Type
Technical Report
Description
Series/Report No
Department
Identifiers
NPS Report Number
NPS-CS-12-005
Sponsors
Funder
Format
Citation
Distribution Statement
Approved for public release; distribution is unlimited.