NSDMiner: Automated discovery of Network Service Dependencies

Abstract

Abstract-Enterprise networks today host a wide variety of network services, which often depend on each other to provide and support network-based services and applications. Understanding such dependencies is essential for maintaining the well-being of an enterprise network and its applications, particularly in the presence of network attacks and failures. In a typical enterprise network, which is complex and dynamic in configuration, it is non-trivial to identify all these services and their dependencies. Several techniques have been developed to learn such dependencies automatically. However, they are either too complex to fine tune or cluttered with false positives and/or false negatives.In this paper, we propose a suite of novel techniques and develop a new tool named NSDMiner (which stands for Mining for Network Service Dependencies) to automatically discover the dependencies between network services from passively collected network traffic. NSDMiner is non-intrusive; it does not require any modification of existing software, or injection of network packets. More importantly, NSDMiner achieves higher accuracy than previous network-based approaches. Our experimental evaluation, which uses network traffic collected from our campus network, shows that NSDMiner outperforms the two best existing solutions significantly.

Detection of stealthy malware activities with traffic causality and scalable triggering relation discovery

“…A TRG provides a structural representation of triggering relations of observed events. Our definition of event-level causal relation relates to, but differs from the service dependency definition in existing service dependency research, such as network service dependency [31] and active delay injection [43]. Service dependency refers to that one service relies on another to function, e.g., web service depends on DNS name resolution.…”

“…The classification and discovery of application or service dependencies for management and reliability purposes have been recently reported [7,9,22,23,31,43]. These existing service dependency analysis solutions differ from our triggering relation discovery work in two aspects.…”

“…Existing dependency analysis work (e.g., [9,31,43]) is on network service level and is not designed for malware detection. For example, Orion [9] and NSDMiner [31] addressed the problem of network application/service dependency for network stability and automatic manageability. Rippler [43] is proposed to actively perturb or delay traffic to understand the dependencies between service and devices.…”

A Graphical Model to Assess the Impact of Multi-Step Attacks

“…Several techniques have been developed to learn such dependencies automatically. In particular, a suite of novel techniques, named NSDMiner (Mining for Network Service Dependencies), was proposed by Natarajan et al 3 to automatically discover the dependencies between network services from passively collected network traffic.…”

POSTER: A semantic-aware approach to reasoning about network traffic relations

“…Most of the existing learning-based security studies are on binary classification problems, where an unknown instance (e.g., email, code, or network packet) needs to be classified into two classes -legitimate or suspicious. Our relation discovery work also differs from existing service dependency analysis (e.g., [1,7]), because of i) our finer granularity (request vs. flow) and ii) different relation semantics.…”