|
Abstract:
|
Cybersecurity, security monitoring of malicious events in IP traffic, is an important field largely unexplored by statisticians. Computer scientists have made significant contributions in this area using statistical anomaly detection and other supervised learning methods to detect specific malicious events. In this research, we investigate the detection of botnet command and control (C&C) hosts in massive IP traffic. Employing interpretative machine learning techniques, botnet traffic signatures are derived. These models were deployed at AT&T for successfully detecting several external botnet hosts and compromised devices.
|
