Detecting malicious clients in ISP networks using HTTP connectivity graph and flow information
Lei Liu, Sabyasachi Saha, Ruben D. Torres, Jianpeng Xu, Pang‐Ning Tan, Antonio Nucci, Marco Mellia · 2014 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM 2014) · 2014
This paper considers an approach to identify previously undetected malicious clients in Internet Service Provider (ISP) networks by combining flow classification with a graph-based score propagation method. Our approach represents all HTTP communications between clients and servers as a weighted, near-bipartite graph, where the nodes correspond to the IP addresses of clients and servers while the links are their interconnections, weighted according to the output of a flow-based classifier. We employ a two-phase alternating score propagation algorithm on the graph to identify suspicious clients in a monitored network. Using a symmetrized weighted adjacency matrix as its input, we show that our score propagation algorithm is less vulnerable towards inflating the malicious scores of popular Web servers with high in-degrees compared to the normalization used in PageRank, a widely used graph-based method. Experimental results on a 4-hour network trace collected by a large Internet service provider showed that incorporating flow information into score propagation significantly improves the precision of the algorithm.