3

For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies.

Our main aim is to find out if there is anomaly in our network. A special case would be to detect reboots. what would be the advantage of analyzing Network anomalies against traditional signature based approach? or what could we find out else with this information?

Note: As far as I know there is just a little bit malware, who reboot computer. Is there any anomaly causing a host to reboot?

Improve this question
2
  • 5
    So... you've decided to do it, and now you want to find out why you should do it?
    – tylerl
    Commented Jan 16, 2013 at 9:33
  • no my professor asks for what would be the advantage of doing that, for our project?
    – smttsp
    Commented Jan 16, 2013 at 9:36

2 Answers 2

Reset to default
1

A memory issue can cause a server to BSOD. If your settings for the BSOD are to automatically reboot, then the server reboots.

Some malware might need to load at startup, so the intruder may trigger a reboot in some way.

Read this article:

http://www.clickonf5.org/7848/howto-solve-frequent-restart-shoutdown-computer/

It shows that reboots are not just caused by malicious people, but by many issues. From an operational standpoint, you would want to know what caused the reboot so you can fix it.

Additionally, the advantage to detecting reboots may be "because our industry requires it." This article http://www.nist.gov/itl/csd/monitoring-012412.cfm and NIST SP 800-137 show some mandates and guidlines for continuous monitoring. Since a reboot be a notable event, you'd want to know what caused it.

Improve this answer
2
  • only reboot wont say anything but if we listen traffic of a host for one month and find out the host slowed down for some percentage for the last 5 days, then we may be able to consider that issue more. with some more addition we may say something about infection or some other thing
    – smttsp
    Commented Jan 16, 2013 at 12:54
  • 2
    Come from an operational standpoint for a moment. If I work for an IT company, a server rebooting randomly is a big deal. Sure we have redundant systems, but "it just happened" is not an acceptable answer to the IT manager. I (or an escalated group) would need to do a Root Cause Analysis of why this server went down. In my investigation, I may uncover malware, or I may just uncover a memory issue. You are correct, Reboots alone don't always give the full picture, but reboots + system performance may provide an answer.
    – Jeff
    Commented Jan 16, 2013 at 13:04
1

From Research perspective your question has very limited use as mentioned by Jeff. What i understand from your question you need to know the application of network based anomaly algorithms for detecting malicious network activity within your network. In short in research different algorithms has been proposed to catch network heuristics for specific malware activity. Few of them are

  1. TRW-CB (Threshold Random Walk with Credit Based Rate Limiting): The anomaly is observed on the observation that number of networks connections made by the benign node is far less as compared to malicious node within the network.
  2. Maximum Entropy Detector : In this algorithms network traffic is modeled into different classes for benign entropy estimation and then divergence of new incoming packets will reveal anomaly depending on the threshold set by network administrator.
  3. Netad A rule based network anomaly algorithm. It calculates a packet score depending on the time and frequency of each byte within the packet. Rare and novel header values are assigned high scores. A threshold is applied on a packets score to find anomalous packets. [source Revisiting Traffic Anomaly Detection using Software Defined Networking]
Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .