Efektivní kNN klasifikace malwaru z HTTPS dat

Maroušek, Jakub

An important task of Network Intrusion Detection Systems (NIDS) is to detect malign com- munication in a computer network traffic. The traditional detection approaches which analyze the content of network packets, are becoming insufficient with an increased usage of encrypted HTTPS protocol. The previous research shows, however, that the high-level properties of HTTPS commu- nication such as the duration of a request or the number of bytes sent/received from the client to the server may be successfully used to detect behavioral patterns of malware activity. We study approximate k-NN similarity joins as one of the methods to build a classifier recognizing malign communication. Three MapReduce-based and one centralized approximate k-NN join methods are reimplemented in order to support large volumes of high-dimensional data. Finally, we thoroughly evaluate all methods on different datasets containing vectors up to 1000 dimensions and compare multiple aspects concerning scalability, approximation precision and classification precision of each approach.

guest :: login Digital Repository
		Search		Submit		Help		About