Probabilistic threat propagation for malicious activity detection

Abstract

In this paper, we present a method for detecting malicious activity within networks of interest. We leverage prior community detection work by propagating threat probabilities across graph nodes, given an initial set of known malicious nodes. We enhance prior work by employing constraints which remove the adverse effect of cyclic propagation that is a byproduct of current methods. We demonstrate the effectiveness of Probabilistic Threat Propagation on the task of detecting malicious web destinations.

Fast botnet detection from streaming logs using online lanczos method

“…Traditional single bots usually execute their tasks at a rate much higher than average human users to achieve their goal within a time limit. Recent single-bot detection methods, like peak-finding [2], outlier detection [3], threat propagation [4], more or less use this property of single bots.…”