MDiET: Malware Detection in Encrypted Traffic

With the increasing adoption of end-to-end encryption in industrial systems, the risk of distributing hidden malware by exploiting encrypted channels gradually turns to a major concern. Due to encryption, the state-of-the-art, signature-based mechanisms might fail to detect malware sufficiently, thus new approaches are required. In this work, a method for malware detection in encrypted traffic based on Machine Learning is presented. A supervised learning approach is adopted and the efficiency of the solution is demonstrated by a set of exhaustive simulations. Further considerations for incorporating the proposed method in a reference industrial network are also discussed.

Content

Author and article information

Contributors

Dimitrios Schoinianakis

Norbert Goetze

Gerald Lehmann

Conference

Publication date: September 2019

Publication date (Print): September 2019

Pages: 31-37

Affiliations

[0001]Nokia Bell Labs

Cyber Security Research

Werinherstr. 91, 81541

Munich, Germany

[0002]Nokia Bell Labs

Data Science

Werinherstr. 91, 81541

Munich, Germany

Article

DOI: 10.14236/ewic/icscsr19.4

SO-VID: fcdbbb3c-b231-4432-b939-95c954d5bed7

License:

This work is licensed under a Creative Commons Attribution 4.0 Unported License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/

Conference name: 6th International Symposium for ICS & SCADA Cyber Security Research 2019

Conference acronym: ICS-CSR

Conference number: 6

Conference location: Athens, Greece

Conference date: 10th-12th September 2019

Conference sponsor: Electronic Workshops in Computing (eWiC)

Conference theme: Cyber Security Research

History

Product

1477-9358 BCS Learning & Development

Self URI (article page): https://www.scienceopen.com/hosted-document?doi=10.14236/ewic/icscsr19.4

Self URI (journal page): https://ewic.bcs.org/

REFERENCES

Amazon S3 Top 1 million websites. URL http://s3.amazonaws.com/alexastatic/top-1m.csv.zip
B. AndersonD. McGrew Identifying encrypted malware traffic with contextual flow data Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security AISec ’16 35 46 2016
CISCO. Whitepaper: Encrypted traffic analysis Jan 2019 URL https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/enterprise-network-security/nb-09-encrytd-trafanlytcs-wp-cte-en.pdf
Cisco Systems URL https://github.com/cisco/joy
A. Greenberg The untold story of NotPetya, the most devastating cyberattack in history URL https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/
H2020 ICT 2016 project 5G-MoNArch Deliverable D3.1: Initial resilience and security analysis Jun 2018 URL https://5g-monarch.eu/smart-sea-port-use-case/
L. H. Newman Menacing malware shows the dangers of industrial system sabotage URL https://www.wired.com/story/triton-malware-dangers-industrial-systemsabotage/
PAiCE. Research projects URL https://www.din.de/en/innovation-and-research/research-projects/industry-4-0/paice-271784
C. Pettey When IT and operational technology converge Jan 2017 URL https://www.gartner.com/smarterwithgartner/when-it-and-operational-technology-converge/
PI North America. PROFINET, industrial ethernet for advanced manufacturing URL http://us.profinet.com/technology/profinet/
Wireshark URL https://www.wireshark.org/
K. Zetter An unprecedented look at Stuxnet, the world’s first digital weapon URL https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/

Comments

Comment on this article

[1] Amazon S3 Top 1 million websites. URL http://s3.amazonaws.com/alexastatic/top-1m.csv.zip

[2] B. AndersonD. McGrew Identifying encrypted malware traffic with contextual flow data Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security AISec ’16 35 46 2016

[3] CISCO. Whitepaper: Encrypted traffic analysis Jan 2019 URL https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/enterprise-network-security/nb-09-encrytd-trafanlytcs-wp-cte-en.pdf

[4] Cisco Systems URL https://github.com/cisco/joy

[5] A. Greenberg The untold story of NotPetya, the most devastating cyberattack in history URL https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/

[6] H2020 ICT 2016 project 5G-MoNArch Deliverable D3.1: Initial resilience and security analysis Jun 2018 URL https://5g-monarch.eu/smart-sea-port-use-case/

[7] L. H. Newman Menacing malware shows the dangers of industrial system sabotage URL https://www.wired.com/story/triton-malware-dangers-industrial-systemsabotage/

[8] PAiCE. Research projects URL https://www.din.de/en/innovation-and-research/research-projects/industry-4-0/paice-271784

[9] C. Pettey When IT and operational technology converge Jan 2017 URL https://www.gartner.com/smarterwithgartner/when-it-and-operational-technology-converge/

[10] PI North America. PROFINET, industrial ethernet for advanced manufacturing URL http://us.profinet.com/technology/profinet/

[11] Wireshark URL https://www.wireshark.org/

[12] K. Zetter An unprecedented look at Stuxnet, the world’s first digital weapon URL https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/

Celebrating 65 years of The Computer Journal - free-to-read perspectives - bcs.org/tcj65