Behavioral Service Graphs: A formal data-driven approach for prompt investigation of enterprise and internet-wide infections. (March 2017)

• Record Type: Journal Article
• Authors: Bou-Harb, Elias; Scanlon, Mark
• Is Part Of: Digital investigation. Volume 20(2016)Supplement
• Page Start: S47
• Page End: S55
• Publication Date: 2017-03
• Subjects: Probing -- Infections -- Graphs -- Threat modeling -- Data analytics -- Network forensics; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2017.02.002
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: The task of generating network-based evidence to support network forensic investigation is becoming increasingly prominent. Undoubtedly, such evidence is significantly imperative as it not only can be used to diagnose and respond to various network-related issues (i.e., performance bottlenecks, routing issues, etc.) but more importantly, can be leveraged to infer and further investigate network security intrusions and infections. In this context, this paper proposes a proactive approach that aims at generating accurate and actionable network-based evidence related to groups of compromised network machines (i.e., campaigns). The approach is envisioned to guide investigators to promptly pinpoint such malicious groups for possible immediate mitigation as well as empowering network and digital forensic specialists to further examine those machines using auxiliary collected data or extracted digital artifacts. On one hand, the promptness of the approach is successfully achieved by monitoring and correlating perceived probing activities, which are typically the very first signs of an infection or misdemeanors. On the other hand, the generated evidence is accurate as it is based on an anomaly inference that fuses data behavioral analytics in conjunction with formal graph theoretic concepts. We evaluate the proposed approach in two deployment scenarios, namely, as an enterprise edge engine and as a global capability in a security operations center model. The empirical evaluation that employs 10 GB of real botnet traffic and 80 GB of real darknet traffic indeed demonstrates the accuracy, effectiveness and simplicity of the generated network-based evidence.