Poster: Feasibility of Malware Traffic Analysis through TLS-Encrypted Flow Visualization

Dongeon Kim; Jihun Han; Jinwoo Lee; Heejun Roh; Wonjun Lee

doi:10.1109/ICNP49622.2020.9259387

Poster: Feasibility of Malware Traffic Analysis through TLS-Encrypted Flow Visualization

Dongeon Kim, Jihun Han, Jinwoo Lee, Heejun Roh, Wonjun Lee

School of Cybersecurity

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

8 Citations (Scopus)

Abstract

With the wide adoption of TLS, malware's use of TLS is also growing fast. However, fine-grained feature selection in existing approaches is too burdensome. To this end, we propose to visualize TLS-encrypted flow metadata as an image for better malware traffic analysis and classification. We discuss its feasibility and show some preliminary classification results with high accuracy.

Original language	English
Title of host publication	28th IEEE International Conference on Network Protocols, ICNP 2020
Publisher	IEEE Computer Society
ISBN (Electronic)	9781728169927
DOIs	https://doi.org/10.1109/ICNP49622.2020.9259387
Publication status	Published - 2020 Oct 13
Event	28th IEEE International Conference on Network Protocols, ICNP 2020 - Madrid, Spain Duration: 2020 Oct 13 → 2020 Oct 16

Publication series

Name	Proceedings - International Conference on Network Protocols, ICNP
Volume	2020-October
ISSN (Print)	1092-1648

Conference

Conference	28th IEEE International Conference on Network Protocols, ICNP 2020
Country/Territory	Spain
City	Madrid
Period	20/10/13 → 20/10/16

Bibliographical note

Funding Information:
ACKNOWLEDGMENT This research was supported by Korea Institute of Science and Technology Information (KISTI). Prof. Heejun Roh is the corresponding author.

Publisher Copyright:
© 2020 IEEE.

Keywords

Mal-ware
Malware Family
TLS Flow Metadata
Transport Layer Security (TLS)
Visualization

ASJC Scopus subject areas

Computer Networks and Communications
Software

Access to Document

10.1109/ICNP49622.2020.9259387

Cite this

Kim, D., Han, J., Lee, J., Roh, H., & Lee, W. (2020). Poster: Feasibility of Malware Traffic Analysis through TLS-Encrypted Flow Visualization. In 28th IEEE International Conference on Network Protocols, ICNP 2020 Article 9259387 (Proceedings - International Conference on Network Protocols, ICNP; Vol. 2020-October). IEEE Computer Society. https://doi.org/10.1109/ICNP49622.2020.9259387

Poster: Feasibility of Malware Traffic Analysis through TLS-Encrypted Flow Visualization. / Kim, Dongeon; Han, Jihun; Lee, Jinwoo et al.
28th IEEE International Conference on Network Protocols, ICNP 2020. IEEE Computer Society, 2020. 9259387 (Proceedings - International Conference on Network Protocols, ICNP; Vol. 2020-October).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Kim, D, Han, J, Lee, J, Roh, H & Lee, W 2020, Poster: Feasibility of Malware Traffic Analysis through TLS-Encrypted Flow Visualization. in 28th IEEE International Conference on Network Protocols, ICNP 2020., 9259387, Proceedings - International Conference on Network Protocols, ICNP, vol. 2020-October, IEEE Computer Society, 28th IEEE International Conference on Network Protocols, ICNP 2020, Madrid, Spain, 20/10/13. https://doi.org/10.1109/ICNP49622.2020.9259387

@inproceedings{c7580739f55f4ab7a883e7c18c43a637,

title = "Poster: Feasibility of Malware Traffic Analysis through TLS-Encrypted Flow Visualization",

abstract = "With the wide adoption of TLS, malware's use of TLS is also growing fast. However, fine-grained feature selection in existing approaches is too burdensome. To this end, we propose to visualize TLS-encrypted flow metadata as an image for better malware traffic analysis and classification. We discuss its feasibility and show some preliminary classification results with high accuracy.",

keywords = "Mal-ware, Malware Family, TLS Flow Metadata, Transport Layer Security (TLS), Visualization",

author = "Dongeon Kim and Jihun Han and Jinwoo Lee and Heejun Roh and Wonjun Lee",

note = "Funding Information: ACKNOWLEDGMENT This research was supported by Korea Institute of Science and Technology Information (KISTI). Prof. Heejun Roh is the corresponding author. Publisher Copyright: {\textcopyright} 2020 IEEE.; 28th IEEE International Conference on Network Protocols, ICNP 2020 ; Conference date: 13-10-2020 Through 16-10-2020",

year = "2020",

month = oct,

day = "13",

doi = "10.1109/ICNP49622.2020.9259387",

language = "English",

series = "Proceedings - International Conference on Network Protocols, ICNP",

publisher = "IEEE Computer Society",

booktitle = "28th IEEE International Conference on Network Protocols, ICNP 2020",

}

TY - GEN

T1 - Poster

T2 - 28th IEEE International Conference on Network Protocols, ICNP 2020

AU - Kim, Dongeon

AU - Han, Jihun

AU - Lee, Jinwoo

AU - Roh, Heejun

AU - Lee, Wonjun

N1 - Funding Information: ACKNOWLEDGMENT This research was supported by Korea Institute of Science and Technology Information (KISTI). Prof. Heejun Roh is the corresponding author. Publisher Copyright: © 2020 IEEE.

PY - 2020/10/13

Y1 - 2020/10/13

N2 - With the wide adoption of TLS, malware's use of TLS is also growing fast. However, fine-grained feature selection in existing approaches is too burdensome. To this end, we propose to visualize TLS-encrypted flow metadata as an image for better malware traffic analysis and classification. We discuss its feasibility and show some preliminary classification results with high accuracy.

AB - With the wide adoption of TLS, malware's use of TLS is also growing fast. However, fine-grained feature selection in existing approaches is too burdensome. To this end, we propose to visualize TLS-encrypted flow metadata as an image for better malware traffic analysis and classification. We discuss its feasibility and show some preliminary classification results with high accuracy.

KW - Mal-ware

KW - Malware Family

KW - TLS Flow Metadata

KW - Transport Layer Security (TLS)

KW - Visualization

UR - http://www.scopus.com/inward/record.url?scp=85097824805&partnerID=8YFLogxK

U2 - 10.1109/ICNP49622.2020.9259387

DO - 10.1109/ICNP49622.2020.9259387

M3 - Conference contribution

AN - SCOPUS:85097824805

T3 - Proceedings - International Conference on Network Protocols, ICNP

BT - 28th IEEE International Conference on Network Protocols, ICNP 2020

PB - IEEE Computer Society

Y2 - 13 October 2020 through 16 October 2020

ER -

Poster: Feasibility of Malware Traffic Analysis through TLS-Encrypted Flow Visualization

Abstract

Publication series

Conference

Bibliographical note

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this