2011 1028

RB-Seeker: Auto-detection of Redirection Botnets ,[object Object],[object Object],[object Object],Xin Hu, Matthew Knysz, and Kang G. Shin University of Michigan Ann Arbor

Outline ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Introduction-Redirecton Botnets

Introduction-Redirecton Botnets ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Introduction-Redirecton Botnets ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Related Work ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Spam Source Subsystem (SSS) ,[object Object],[object Object],[object Object],[object Object]

Spam Source Subsystem (SSS) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Netflow Analysis Subsystem (NAS) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Netflow Analysis Subsystem (NAS) ,[object Object],[object Object]

Netflow Analysis Subsystem (NAS) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Netflow Analysis Subsystem (NAS) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Netflow Analysis Subsystem (NAS) Flow-based Redirection Indentification

Netflow Analysis Subsystem (NAS) ,[object Object]

Netflow Analysis Subsystem (NAS) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Netflow Analysis Subsystem (NAS)

Active DNS Anomaly Detection Subsystem ,[object Object],[object Object],[object Object]

Active DNS Anomaly Detection Subsystem ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Active DNS Anomaly Detection Subsystem

Active DNS Anomaly Detection Subsystem

Evaluation of RBnet Classifier ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Evaluation of RBnet Classifier Low FP Rate of ＜ 0.004% 3790 281 RB-Seeker 1 week 249 156 SVM-2 2 3541 125 SVM-1 Valid Queries RBnet IPs RBnet Domains

Evaluation of RBnet Classifier ,[object Object],[object Object],[object Object],[object Object],[object Object]

Conclusion ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Q & A ,[object Object],[object Object]

2011 1028

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (16)

Similaire à 2011 1028

Similaire à 2011 1028 (20)

Dernier

Dernier (20)

2011 1028