![](bg6.png)
4 CONCLUSION
The current prototype of the system has been imple-
mented in a test-bed environment consisting of 10
physical Windows machines actively used by devel-
opers and office personnel. The deployed kernel mon-
itoring agent logs all the event types described in sec-
tion 3.1 to a central listener that in turn writes the
events to a database server. SQL is used to query
the database and to construct the star structures that
are the basis for all further processing. Our approach
is able to selectively retrieve entire system sessions
or pick out individual processes, whereby any tem-
poral range can be specified. For example, we can
process only the first n seconds after an application’s
launch or extract data from a specific point within its
lifetime. The resulting set of CSV-formatted graphs
is converted into matrices that are the foundation of
Hungarian distance calculations implemented in R.
The correlation of network flow events and process
information is handled by a Python-based framework
capable of grouping destination IP addresses by do-
main owner. For prototype-based template genera-
tion, we utilize a local Malheur (Rieck et al., 2011) in-
stallation configured to accept non-MIST input data.
Decision trees are computed in GAtree (Papagelis and
Kalles, 2000). Initial evaluation puts the computa-
tional requirements of the anomaly detection routines
in the span of seconds to minutes, depending on the
size of the graphs. Preliminary tests using the Win-
dows generic host process against 18 automatically
generated prototype templates have yielded correct
anomaly detection results for a total of 81 out of 83
system sessions infected by over 15 classes of mal-
ware. The remainder was deemed inconclusive due
to a lack of activity. A detailed evaluation of the sys-
tem’s anomaly detection accuracy and its reasoning
capabilities will be discussed in future works. Fur-
ther research will also be conducted into the improve-
ment of the decision tree as well as the automation of
the ontology mapping process. Ultimately, the intro-
duced anomaly detection and explication system will
offer invaluable aid to malware analysts and security
operators alike.
ACKNOWLEDGMENTS
The financial support by the Austrian Federal Min-
istry of Science, Research and Economy and the Na-
tional Foundation for Research, Technology and De-
velopment is gratefully acknowledged.
REFERENCES
Anagnostopoulos, T., Anagnostopoulos, C., and Had-
jiefthymiades, S. (2005). Enabling attack behavior
prediction in ubiquitous environments. In Int. Con-
ference on Pervasive Services, pages 425–428. IEEE.
Dolgikh, A., Nykodym, T., Skormin, V., and Birnbaum, Z.
(2012). Using behavioral modeling and customized
normalcy profiles as protection against targeted cyber-
attacks. In Computer Network Security, pages 191–
202. Springer.
Dornhackl, H., Kadletz, K., Luh, R., and Tavolato, P.
(2014). Malicious behavior patterns. In 2014 IEEE
8th Intl. Symposium on Service Oriented System En-
gineering (SOSE), pages 384–389. IEEE.
Hu, X., Chiueh, T.-c., and Shin, K. G. (2009). Large-scale
malware indexing using function-call graphs. In 16th
conference on Computer and communications secu-
rity, pages 611–620. ACM.
Hutchins, E. M., Cloppert, M. J., and Amin, R. M.
(2011). Intelligence-driven computer network defense
informed by analysis of adversary campaigns and in-
trusion kill chains. Leading Issues in Information
Warfare & Security Research, 1:80.
Kuhn, H. W. (1955). The hungarian method for the as-
signment problem. Naval research logistics quarterly,
2(1-2):83–97.
Luh, R., Marschalek, S., Kaiser, M., Janicke, H., and Schrit-
twieser, S. (2016a). Semantics-aware detection of tar-
geted attacks: a survey. Journal of Computer Virology
and Hacking Techniques, pages 1–39.
Luh, R., Schrittwieser, S., and Marschalek, S. (2016b).
TAON: An ontology-based approach to mitigating tar-
geted attacks. In iiWAS 2016. ACM.
M
¨
unz, G. and Carle, G. (2007). Real-time analysis of flow
data for network attack detection. In 10th IFIP/IEEE
Int. Symposium on Integrated Network Management,
pages 100–108. IEEE.
Noble, C. C. and Cook, D. J. (2003). Graph-based anomaly
detection. In 9th Intl. conference on knowledge dis-
covery and data mining, pages 631–636. ACM.
Papagelis, A. and Kalles, D. (2000). GA Tree: genetically
evolved decision trees. In 12th Intl. Conference on
Tools with Artificial Intelligence, page 203.
Rieck, K., Trinius, P., Willems, C., and Holz, T. (2011). Au-
tomatic analysis of malware behavior using machine
learning. Journal of Computer Security.
Sheyner, O., Haines, J., Jha, S., Lippmann, R., and Wing,
J. M. (2002). Automated generation and analysis of
attack graphs. In IEEE Symposium on Security and
privacy, pages 273–284. IEEE.
Sperotto, A., Schaffrath, G., Sadre, R., Morariu, C., Pras,
A., and Stiller, B. (2010). An Overview of IP Flow-
Based Intrusion Detection. IEEE Communications
Surveys & Tutorials, 12(3):343–356.
Wagner, M., Fischer, F., Luh, R., Haberson, A., Rind, A.,
Keim, D., Aigner, W., Borgo, R., Ganovelli, F., and
Viola, I. (2015). A Survey of Visualization Systems
for Malware Analysis. In Eurographics Conference
on Visualization, pages 105–125. EuroGraphics.
ICISSP 2017 - 3rd International Conference on Information Systems Security and Privacy
402