Two-Phased Method for Detecting Evasive Network Attack Channels

doi:10.1109/CC.2014.6911087

Two-Phased Method for Detecting Evasive Network Attack Channels

2014-08-01

0

PRE

AI

DOI：10.1109/CC.2014.6911087

原文链接

原文求助

摘要

En 中文

With the rapid developments of information technology, various industries become much more dependent on networks. Driven by economic interests and the game between countries reflected by growing cyberspace confrontations, evasive network attacks on information infrastructures with high-tech, high concealment and long-term sustainability become severe threats to national security. In this paper, we propose a novel two-phased method for the detection of evasive network attacks which exploit or pretend to be common legal encryption services in order to escape security inspection. Malicious communications which camouflage themselves as legal encryption application are identified in the SSL1 session structure verification phase firstly, and then by server-side X.509 certificate based anomaly detection, suspicious attack behaviors are further distinguished effectively. Experiment results show that our method is very useful for detecting the network activities of certain unknown threats or new malwares. Besides, the proposed method can be applied to other similar services easily.

Keyword:

evasive network attacks

encryption

SSL

X.509 certificate

anomaly detection

Two-Phased Method for Detecting Evasive Network Attack Channels

摘要

AI总结

期刊

机构

引用论文