a b s t r a c t Any machine exposed to the Internet today is at the risk of being attacked and compromised. Detecting attack attempts, be they successful or not, is important for securing networks (servers, end-hosts and other assets) as well as for forensic analysis. In this context, we focus on the problem of evidence gathering by detecting fundamental patterns in network traffic related to suspicious activities. Detecting fundamental anomalous patterns is necessary for a solution to be able to detect as many types of attacks and malicious activities as possible. Our evidence gathering framework correlates multiple patterns detected, thereby increasing the confidence of detection, and resulting in increase in accuracy and decrease in false positives. We demonstrate the effectiveness of our framework by evaluating on a dataset consisting of normal traffic as well as traffic from a number of malwares.  End-hosts and networks become prone to attacks and compromises once they get connected to the Internet. The types and sophistication of attacks have only been increasing with time, one of the motivations being the monetary profits that cyber-criminals obtain from such malicious and cyberecriminal activities. To quantify, in its annual security report of 2016, Cisco's estimation of the average annual income for ransomware per campaign is $34 million (Cisco Annual Security Report, 2016). Detection of anomalies related to attacks is imperative for securing a network as well as for forensic analysis. Timely detection can thwart damages due to the attack; forensic analysis of the anomalies aid not only in investigations but also in profiling of attacks. There exist a plethora of research works on detecting anomalies and attacks in networks (Carl et al. (2006 ), Feily et al. (2009 ), Chandola et al. (2009 ), Vincent Zhou et al. (2010 and Bhuyan et al. (2014) are some relevant surveys). Often, different solutions are developed for different attacks, leading to complex management and higher costs for the users. Besides, individual anomalies are usually detected independently; and without having a mechanism to check if some of the detected anomalies are correlated, solutions could easily miss the forest for the trees. Worse, the detected anomalies might be assigned a low risk, and therefore ignored by an analyst. Differing from the previous works, our aim is to develop a framework that can gather as many evidences as possible for different types of attacks and malicious activities. In this work, we focus on the problem of evidence gathering by analyzing network traffic. The evidences are the fundamental patterns related to suspicious activities. Detecting such patterns allows for detection of anomalies that are common to a number of attacks. We take a pragmatic approach in detecting anomalous patterns; we apply regression models to analyze network traffic data and detect patterns related to suspicious activities. The anomalous patterns, which form evidences, are correlated and analyzed, to increase the performance of detection of traffic related to attacks and malicious activities, where performance is expressed in terms of detection accuracy and false positive rate. The advantages of our proposed system are: 1. No learning of normal behavior using benign data: Given that Internet traffic is always evolving and changing, a solution that models static data will not be adaptive. Besides, it is extremely difficult to obtain a real-life up-to-date traffic dataset of meaningful size that consists of only benign flows and captures the dynamic characteristics of benign traffic. Our approach, on the other hand, uses information of only attack traffic. Characteristics of attack traffic are very specific to the kind of attack, and also differs significantly from that of normal traffic. 2. Detection of multiple anomalous patterns: By detecting anomalous patterns in network traffic, our solution essentially gathers evidences related to the attack. For a single attack, there might be multiple patterns that are detected, some due to different
Divakaran et al. REF studied the issues related to forensics and network security.
Evidence gathering for network security and forensics
Digital Investigation
Computer Science