Detection of zero-day attacks: An unsupervised port-based approach

Abstract

Last years have witnessed more and more DDoS attacks towards high-profile websites, as the Mirai botnet attack on September 2016, or more recently the memcached attack on March 2018, this time with no botnet required. These two outbreaks were not detected nor mitigated during their spreading, but only at the time they happened. Such attacks are generally preceded by several stages, including infection of hosts or device fingerprinting; being able to capture this activity would allow their early detection. In this paper, we propose a technique for the early detection of emerging botnets and newly exploited vulnerabilities, which consists in (i) splitting the detection process over different network segments and retaining only distributed anomalies, (ii) monitoring at the port-level, with a simple yet efficient changedetection algorithm based on a modified Z-score measure. We argue how our technique, named Split-and-Merge, can ensure the detection of large-scale attacks and drastically reduce false positives. We apply the method on two datasets: the MAWI dataset, which provides daily traffic traces of a transpacific backbone link, and the UCSD Network Telescope dataset which contains unsolicited traffic mainly coming from botnet scans. The assumption of a normal distributionfor which the Z-score computation makes sense-is verified through empirical measures. We also show how the solution generates very few alerts; an extensive evaluation on the last three years allows identifying major attacks (including Mirai and memcached) that current Intrusion Detection Systems (IDSs) have not seen. Finally, we classify detected known and unknown anomalies to give additional insights about them.

Zero Day Threat Detection Using Graph and Flow Based Security Telemetry

“…Lobato, Lopez, et al [14] utilize supervised machine learning approaches such as Support Vector Machines (SVM) and Stochastic Gradient Descent (SGD) Algorithms to classify network flow telemetry as malicious or benign using an adaptive data modeling and pipeline approach with promising results, achieving precision and recall values between 65.7% and 97.3%. Blaise et al [15] utilized network flow telemetry to identify ZDTs using an unsupervised approach that identifies anomalous port usage. Sarhan et al [16] also utilized network flow telemetry to identify ZDTs using a Zero-Shot Learning approach with Random Forest (RF) and Multi-layer Perceptron (MLP) models using a novel data splitting approach to hold out attack classes as ZDTs to measure performance.…”

An Improved K -Means Clustering Intrusion Detection Algorithm for Wireless Networks Based on Federated Learning

“…Different attributes in the data set have different ranges. To reduce the impact of such difference on the detection model, we can use z-score standardization [25,26] on the data to make it a normal distribution. Using distance to measure similarity and the PCA to reduce dimensions, the z-score normalization is better than the Minmax normalization in classification and clustering algorithms.…”

Memcached: An Experimental Study of DDoS Attacks for the Wellbeing of IoT Applications

“…Memcached is a database-caching system used to speed up websites’ dynamic databases by caching frequent data in DRAM. Memcached uses a key-value method to store data, and it solves the problem of having an extensive data cache [ 53 ].…”

“…The Memcached mechanism was designed to work internally, but it became exposed to unauthenticated servers, enabling exploitation via DDoS attacks [ 53 ]. A case in which IoT botnets can be deployed is shown in Figure 5 , where vulnerable Memcached servers are used for launching attacks.…”