Detecting polling behaviour in a computer network has two important applications. First, the polling can be indicative of malware beaconing, where an undetected software virus sends regular communications to a controller. Second, the cause of the polling may not be malicious, since it may correspond to regular automated update requests permitted by the client, to build models of normal host behaviour for signature-free anomaly detection, this polling behaviour needs to be understood. This article presents a simple Fourier analysis technique for identifying regular polling, and focuses on the second application: modelling the normal behaviour of a host, using real data collected from the computer network of Imperial College London.
|Number of pages||4|
|Publication status||Published - 26 Sep 2014|
|Event||Intelligence and Security Informatics Conference (JISIC), 2014 IEEE Joint - The Hague, Netherlands|
Duration: 24 Sep 2014 → 26 Sep 2014
|Conference||Intelligence and Security Informatics Conference (JISIC), 2014 IEEE Joint|
|Period||24/09/14 → 26/09/14|