MAGMA network behavior classifier for malware traffic

• Published in: Computer networks (Amsterdam, Netherlands : 1999) Vol. 109; pp. 142 - 156
• Main Authors: Bocchi, Enrico, Grimaudo, Luigi, Mellia, Marco, Baralis, Elena, Saha, Sabyasachi, Miskovic, Stanislav, Modelo-Howard, Gaspar, Lee, Sung-Ju
• Format: Journal Article
• Language: English
• Published: Amsterdam Elsevier B.V 09.11.2016; Elsevier Sequoia S.A
• Subjects: Automatic classification; Classifiers; Computer viruses; Cybersecurity; Data management; Datasets; Feature extraction; Graph networks; Internet; Intrusion detection systems; Magma; Malicious behaviors detection; Malware; Malware characterization; Multilayers; Network traffic modeling; Parameter robustness; Protocol (computers); Studies; Network traffic modeling; Graph networks; Automatic classification; Malware characterization; Malicious behaviors detection
• ISSN: 1389-1286; 1872-7069
• DOI: 10.1016/j.comnet.2016.03.021

Malware is a major threat to security and privacy of network users. A large variety of malware is typically spread over the Internet, hiding in benign traffic. New types of malware appear every day, challenging both the research community and security companies to improve malware identification techniques. In this paper we present MAGMA, MultilAyer Graphs for MAlware detection, a novel malware behavioral classifier. Our system is based on a Big Data methodology, driven by real-world data obtained from traffic traces collected in an operational network. The methodology we propose automatically extracts patterns related to a specific input event, i.e., a seed, from the enormous amount of events the network carries. By correlating such activities over (i) time, (ii) space, and (iii) network protocols, we build a Network Connectivity Graph that captures the overall “network behavior” of the seed. We next extract features from the Connectivity Graph and design a supervised classifier. We run MAGMA on a large dataset collected from a commercial Internet Provider where 20,000 Internet users generated more than 330 million events. Only 42,000 are flagged as malicious by a commercial IDS, which we consider as an oracle. Using this dataset, we experimentally evaluate MAGMA accuracy and robustness to parameter settings. Results indicate that MAGMA reaches 95% accuracy, with limited false positives. Furthermore, MAGMA proves able to identify suspicious network events that the IDS ignored.