Distilling command and control network intrusions from network flow metadata using temporal PageRank

Abstract

Malicious network intrusions which exfiltrate data from computer networks are extremely damaging for organisations and governments worldwide. Combating these network intrusions and large-scale cyber-attacks requires mining and analysis of large volumes of computer network data. We present a statistical filtering and temporal PageRank technique that improves the probability of discovering network intrusions. The technique filters out benign network data such that the data remaining is more pertinent and likely to contain malicious command and control (C2) traffic. We then propose a novel application of Google's PageRank algorithm by incorporating temporal analysis and evaluating a time-series of page rankings for identifying C2 like traffic. Two case studies using data collected at the gateway of an enterprise network and at the Internet backbone are presented to support our technique.