Year: 2023
Type: conference-paper
Abstract: The authors of the article made an analysis and found out that most network protection systems are aimed at analyzing incoming traffic. In order to detect the original malicious traffic, a method of signature analysis and a system implementing it have been developed. The results of the study are the basis for continuing work in this area with the aim of automating the process of creating signature dictionaries and identifying signature categories. In order to ensure minimal resource costs for system operation during the development of the method based on the Pareto principle, parameters were chosen for the formation of signatures containing the most necessary information when detecting malicious traffic. The method of signature analysis of outgoing traffic performs a real-time comparison of outgoing traffic signatures with a signature dictionary. The main task of the method is an authorization of connections from the allowed list; blocking of connections from the prohibited list; an authorization of connections and marking the packet as unidentified if the packet signature is not in the allowed or prohibited lists. The approach for detecting anomalous outgoing traffic during the experiment demonstrated its effectiveness against known attacks. But it is not adapted to zero-day attacks.
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W7166321942