Can the User Help? Leveraging User Actions for Network Profiling

Abstract

Enterprises have difficulty gaining insight into the steps preceding anomalous activity in end-user machines. En-terprises may log events to later reconstruct anomalies to gain insight and determine their causes. Unfortunately, most logs are low-level and lack contextual information, making manual inspection arduous. Accordingly, enterprises may fail to promptly respond to anomalies, leading to outages or security breaches. To help these enterprises, we monitor and log each user's interactions with the machine's user interface (UI) and link them to the resulting network flows. We design, implement, and evaluate an SDN system, called Harbinger, for the Microsoft Windows OS that provides user activity context for flows. Enterprises can use the context we gather to complement traditional analysis. We explore how Harbinger can help differentiate normal and abnormal network traffic. While IP or DNS host name profiling can have error rates between 29%-38 % for URL-based traffic, UI-aware sensors can reduce such errors to 0.2%. We further find that with the help of user action tracking, we can detect errant network traffic 99.1% of the time in our tests. HARBINGERhas good performance, introducing less than 6 milliseconds of delay in 95% of new network flows.