# Unexpected-Behavior Detection Using TopK Rankings for Cybersecurity
## 6 Experiments and Results  
We conducted an experiment to validate the proposed methodology and its ability to detect unexpected behaviors. The experiment was carried out in a 16-bit campus area network (CAN); it had a Windows domain controller and used an HTTP proxy. The campus applications included web-apps and remote desktop apps. The email service was provided by Microsoft Exchange Server which was hosted outside of the campus network. Figure 8: Moving-average filter example. Diamond \(A\) represents the average of \(S\) from 9:00 to 9:20 and diamond \(B\) represents the average of \(S\) from 9:10 to 9:30. Figure 9: Applying the moving-average filter to represent a predominant behavior with a threshold \(T=0.40\). Five faculty members took part in this experiment. They were endowed with brand new laptops by the IT department. Each laptop was set up with the fresh institutional image. No unauthorized software was installed. The traffic generated on each of their computers during the first month was selected as normal behavior. Each laptop had two types of network accesses: (1) a wired access with a static IP address and (2) a wireless access with a dynamic IP address. Most of the time, they used their laptops inside the campus; however, sometimes they used them outside. The traffic data was captured by means of a Java application that used the Pcap4J library ([[https://www.pcap4j.org/](https://www.pcap4j.org/)]([https://www.pcap4j.org/](https://www.pcap4j.org/))). This program was installed on each laptop as an auto-start service. The traffic generated on each of their computers during the first month was selected as normal behavior and, therefore, used to build the profile of each of the professors. Then, the real-time traffic of each user was captured and processed through the steps of the methodology proposed. In the mean time, a malware was installed on each laptop with the purpose of inducing an unexpected behavior. This malware transferred files from the laptop to an external server. After copying 1 GB of data, the malware finished its execution and removed itself. The malware was created with the Metasploit ([[https://www.metasploit.com/](https://www.metasploit.com/)]([https://www.metasploit.com/](https://www.metasploit.com/))) framework using a reverse HTTPS Metepreter payload that connected to the Metasploit server that was hosted outside of the university. Figure 9(a)-e depicts the predominant network behavior of the five faculty members, identified as Users \(A\) to \(E\), during the execution of the malware, an hour before it started, and a couple of hours after it finished. The first valley in each plot represents the predominant behavior during the attack. Each plot includes a green line that represents the threshold \(T\) at \(PB=0.4\) denoting the lower bound on \(PB\) of a predominant behavior which can be labeled as expected. This bound was selected experimentally. Figure 10: _Cont._  
Figure 11 depicts the predominant behavior of a single user during a full work week. The periods of time during which the user seemed to exhibit an unexpected behavior are highlighted. After interviewing the user, we obtained the following explanations for these behaviors which are labeled in the plot with letters A to F: (A) the user was connected outside of the campus making personal use of the laptop, (B) the user decided to use the computer for entertainment during lunch time, (C) the user was doing some activity not registered in the profile, (D) the intentional malware was running, (E) the user was doing some activity not registered in the profile, and (F) the user had not started working yet, so it could have been system traffic such as software update. Similarly, Figure 12 depicts the predominant behavior of another user during a full work week. We can observe a more stable user that exhibited only two moments of unexpected network behavior: the first one (A) was very near lunch time, so maybe the user did something unusual like a video conference; the second one (B) was the intentional malware attack.