BotFlowMon: Learning-based, Content-Agnostic Identification of Social Bot Traffic Flows

Feng, Yebo; Li, Jun; Jiao, Lei; Wu, Xintao

doi:10.1109/cns.2019.8802706

Cited by 8 publications

(2 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other traffic classification approaches have been proposed, including packet-based classification [19,23], clustering and machine-learning [20,24,25,30,34,42]. These approaches require transport-level statistics such as packet inter-arrival time, or volume of traffic in each direction, which our sampled Netflow records do not have.…”

Section: Traffic Classificationmentioning

confidence: 99%

Measuring Changes in Regional Network Traffic Due to COVID-19 Stay-at-Home Measures

Mirković¹,

Feng²,

Li³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

During the 2020 pandemic caused by the COVID-19 virus, many countries implemented stay-at-home measures, which led to many businesses and schools moving from in-person to online mode of operation. We analyze sampled Netflow records at a medium-sized US Regional Optical Network to quantify the changes in the network traffic due to stay-athome measures in that region. We find that human-driven traffic in the network decreases to around 70%, and mostly shifts to local ISPs, while VPN and online meeting traffic increases up to 5 times. We also find that networks adopt a variety of online meeting solutions and favor one but continue using a few others. We find that educational and government institutions experience large traffic changes, but aim to keep their productivity via increased online meetings. Some scientific traffic also reduces possibly leading to loss of research productivity. Businesses mostly lose their traffic and few show VPN or online meeting activity. Most network prefixes experience large loss of live addresses but a handful increase their liveness. We also find increased incidence of network attacks. Our findings can help plan network provisioning and management to prepare for future possible infection outbreaks and natural disasters.

show abstract

Section: Traffic Classificationmentioning

confidence: 99%

Measuring Changes in Regional Network Traffic Due to COVID-19 Stay-at-Home Measures

Mirković¹,

Feng²,

Li³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…The traffic flow is metadata of network operations and contains no content information from the sender. Recently, detecting application-layer anomalies with network traffic flows has become a trend [3], because such approaches are content-agnostic, which can protect user privacy while simultaneously detecting potential malicious activities in a network. With this feature, our approach is privacy preserving compared with the aforementioned cryptojacking detection solutions.…”

mentioning

confidence: 99%

POSTER: Content-Agnostic Identification of Cryptojacking in Network Traffic

Feng

Sisodia

2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

In this paper, we propose a method that detects cryptojacking activities by analyzing content-agnostic network traffic flows. Our method first distinguishes crypto-mining activities by profiling the traffic with fast Fourier transform at each time window. It then generates the variation vectors between adjacent time windows and leverages a recurrent neural network to identify the cryptojacking patterns. Compared with the existing approaches, this method is privacy-preserving and can identify both browser-based and malware-based cryptojacking activities. Additionally, this method is easy to deploy. It can monitor all the devices within a network by accessing packet headers from the gateway router. CCS CONCEPTS • Networks → Network monitoring; • Security and privacy → Intrusion/anomaly detection and malware mitigation.

show abstract