Forest Global Training Partners

Cyber Risks · Cisco Talos

Cognitive Research: Learning Detectors of Malicious Network Traffic

Summary: Cisco Talos researchers Karel Bartos, Vojtech Franc and Michal Sofka describe a detector that trains on domain-level labels from blocklists, security reports and sandboxing analysis, then classifies individual HTTP proxy flows using 305 features such as URL structure, byte counts, user agent, HTTP status, MIME type and port. The method, a modification of Multi-Instance Support Vector Machines called Multiple Instance Learning, was evaluated on 14 days of real traffic from a company with 80,000 seats and tested across five malware categories: command and control, domain generation algorithm, DGA exfiltration, click fraud and trojans.

Bottom line: The approach targets a very low false positive rate by design, because at 80,000 seats the volume of legitimate traffic makes false positives the binding constraint on deployment. The technology is integrated into Cisco CWS Premium as Cognitive Threat Analytics.

Read the original at Cisco Talos ↗

Topics
Malware
Related