English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Recent self-propagating malware (SPM) campaigns compromised hundred ofthousands of victim machines on the Internet. It is challenging to detect theseattacks in their early stages, as adversaries utilize common network services,use novel techniques, and can evade existing detection mechanisms. We proposePORTFILER (PORT-Level Network Traffic ProFILER), a new machine learning systemapplied to network traffic for detecting SPM attacks. PORTFILER extractsport-level features from the Zeek connection logs collected at a border of amonitored network, applies anomaly detection techniques to identify suspiciousevents, and ranks the alerts across ports for investigation by the SecurityOperations Center (SOC). We propose a novel ensemble methodology foraggregating individual models in PORTFILER that increases resilience againstseveral evasion strategies compared to standard ML baselines. We extensivelyevaluate PORTFILER on traffic collected from two university networks, and showthat it can detect SPM attacks with different patterns, such as WannaCry andMirai, and performs well under evasion. Ranking across ports achieves precisionover 0.94 with low false positive rates in the top ranked alerts. When deployedon the university networks, PORTFILER detected anomalous SPM-like activity onone of the campus networks, confirmed by the university SOC as malicious.PORTFILER also detected a Mirai attack recreated on the two university networkswith higher precision and recall than deep-learning-based autoencoder methods.

PORTFILER: Port-Level Network Profiling for Self-Propagating Malware Detection