DANTE：挖掘和监控暗网流量的框架
DANTE: A framework for mining and monitoring darknet traffic
摘要：
数以万亿计的网络数据包通过互联网发送到不存在的目的地。这种“暗网”流量捕获僵尸网络和其他恶意活动的活动，旨在发现和危害世界各地的设备。为了从这些数据中挖掘威胁情报，必须能够处理大量日志流，并以有意义的方式表示流量模式。但是，通过观察网络端口（服务）的使用方式，可以捕获每次传输的意图。在本文中，我们提出了DANTE：一个挖掘暗网流量的框架和算法。DANTE通过将Word2Vec应用于观察到的端口序列来学习目标网络端口的含义。然后，当主机发送新序列时，DANTE将传输表示为找到该序列的端口的平均嵌入。最后，DANTE使用一种新的增量时间序列集群跟踪算法来检测重复出现的行为和新出现的威胁。为了评估该系统，我们在欧洲最大的电信提供商德国电信收集的全年暗网流量（超过3万亿次）上运行了DANTE，并分析了结果。DANTE发现了1，177个新出现的威胁，并能够随着时间的推移跟踪恶意活动。我们还将DANTE与目前最好的方法进行了比较，发现DANTE在检测暗网流量模式方面更实用，更有效。
英文摘要：
Trillions of network packets are sent over the Internet to destinations which do not exist. This 'darknet' traffic captures the activity of botnets and other malicious campaigns aiming to discover and compromise devices around the world. In order to mine threat intelligence from this data, one must be able to handle large streams of logs and represent the traffic patterns in a meaningful way. However, by observing how network ports (services) are used, it is possible to capture the intent of each transmission. In this paper, we present DANTE: a framework and algorithm for mining darknet traffic. DANTE learns the meaning of targeted network ports by applying Word2Vec to observed port sequences. Then, when a host sends a new sequence, DANTE represents the transmission as the average embedding of the ports found that sequence. Finally, DANTE uses a novel and incremental time-series cluster tracking algorithm on observed sequences to detect recurring behaviors and new emerging threats. To evaluate the system, we ran DANTE on a full year of darknet traffic (over three Tera-Bytes) collected by the largest telecommunications provider in Europe, Deutsche Telekom and analyzed the results. DANTE discovered 1,177 new emerging threats and was able to track malicious campaigns over time. We also compared DANTE to the current best approach and found DANTE to be more practical and effective at detecting darknet traffic patterns.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
