Multi-label Classification of Hosts Observed through a Darknet - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2023

Multi-label Classification of Hosts Observed through a Darknet

Résumé

To observe compromised hosts at Internet-scale, a darknet or network telescope collects Internet background radiation that includes large-scale phenomena like DDoS (Distributed Denial-of-Service) or scanning. Gathered data is however very partial and labeling such traffic to precise activities thanks to external databases is far from being satisfactory (8.4% of IP addresses in our case). In addition, as compromised hosts are used for multiple malicious activities, they cannot be classified in a unique category. We propose in this paper a new multi-label classification method by representing traffic generated by a host as a graph and leveraging machine learning algorithms (Node embedding and Graph Convolutional Networks). From partial information about IP addresses, our method can label addresses with a precision of 0.80 and recall of 0.81.
Fichier principal
Vignette du fichier
paper.pdf (457.4 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04180419 , version 1 (12-08-2023)

Licence

Paternité

Identifiants

Citer

Enzo d'Andréa, Jérôme François, Olivier Festor, Mehdi Zakroum. Multi-label Classification of Hosts Observed through a Darknet. NOMS 2023 - IEEE/IFIP Network Operations and Management Symposium (NOMS) - Experience Session, May 2023, Miami, United States. ⟨10.1109/NOMS56928.2023.10154356⟩. ⟨hal-04180419⟩
45 Consultations
25 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More