User-Assisted Host-Based Detection of Outbound Malware Traffic

Abstract. Conventional network security solutions are performed on network-layer packets using statistical measures. These types of traffic analysis may not catch stealthy attacks carried out by today’s malware. We aim to develop a host-based security tool that identifies suspicious outbound network connec-tions through analyzing the user’s surfing activities. Specifically, our solution for Web applications predicts user’s network connections by analyzing Web con-tent; unpredicted traffic is further investigated with the user’s help. We describe our method and implementation as well as the experimental results in evalu-ating its efficiency and effectiveness. We describe how our studies can be ap-plied to detecting bot infection. In order to assess the workload of our host-based traffic-analysis tool, we also perform a large-scale characterization study on 500 university-users ’ wireless network traces for 4-month period. We study both the statistical and temporal patterns of individuals ’ web usage behaviors from col-lected wireless network traces. Users are classified into different profiles based on their web usage patterns. Our results show that users have regularities in their Web activities and the expected workload of our traffic-analysis solution is low.