Traffic Aggregation for Malware Detection

Abstract. Stealthy malware, such as botnets and spyware, are hard to detect because their activities are subtle and do not disrupt the network, in contrast to DoS attacks and aggressive worms. Stealthy malware, however, does communicate to exfiltrate data to the attacker, to receive the attacker's commands, or to carry out those commands. Moreover, since malware rarely infiltrates only a single host in a large enterprise, these communications should emerge from multiple hosts within coarse temporal proximity to one another. In this paper, we describe a system called T

• Type: Conference
• Year: 2008
• Where: DIMVA
• Authors: Ting-Fang Yen, Michael K. Reiter
• Keywords: Computer Networks, DIMVA 2008, Infected Hosts, Internal Hosts, Stealthy Malware