Aplikace umělých neuronových sítí pro detekci malware v HTTPS komunikaci

Bodnár, Jan

A huge proportion of modern malicious software uses Internet connec- tions. Therefore, it is possible to detect infected computers by inspecting network activity. Since attackers hide the content of communication by com- municating over encrypted protocols such as HTTPS, communication must be analysed purely on the basis of metadata. Cisco provided us a dataset containing aggregated metadata with additional information as to whether or not each sample contains malicious communication. This work trains neu- ral networks to distinguish between infected and benign samples, comparing different architectures of neural networks and providing a comparison with results achieved by different machine learning methods tried by colleagues. It also seeks to create a mapping which maps samples of communication into a space where different samples of malicious communication created by a sin- gle malware family form clusters. This may make it easier to find different computers infected by a virus with known behaviour, even when the virus cannot be detected by the detection system. 1

host :: přihlásit Digitální repozitář
		Hledej		Nový záznam		Nápověda		O repozitáři