Conference Papers Year : 2024

DYNAMO: Towards Network Attack Campaign Attribution via Density-Aware Active Learning

Abstract

Network attack attribution is crucial for identifying and understanding attack campaigns, and implementing preemptive measures. Traditional machine learning approaches face challenges such as labor-intensive cam- paign annotation, imbalanced attack data distribution, and concept drift. To address these challenges, we propose DYNAMO, a novel weakly supervised and human-in-the-loop machine learning framework for au- tomated network attack attribution using raw network traffic records. DYNAMO integrates self-supervised learning and density-aware active learning techniques to reduce the overhead of exhaustive annotation, query- ing human analysts to label only a few selected highly representative network traffic samples. Our experiments on the CTU-13 dataset demonstrate that annotating less than 3% of the records achieves attribution accuracy comparable to fully supervised approaches with twice as many labeled records. Moreover, compared to clas- sic active learning and semi-supervised techniques, DYNAMO achieves 20% higher attribution accuracy and nearly perfect detection accuracy for unknown botnet campaigns with minimal annotations.
Fichier principal
Vignette du fichier
127591.pdf (589.82 Ko) Télécharger le fichier
Origin Files produced by the author(s)

Dates and versions

hal-04877620 , version 1 (10-01-2025)

Licence

Identifiers

Cite

Helene Orsini, Yufei Han. DYNAMO: Towards Network Attack Campaign Attribution via Density-Aware Active Learning. SECRYPT 2024 - 21st International Conference on Security and Cryptography, Jul 2024, Dijon, France. pp.91-102, ⟨10.5220/0012759100003767⟩. ⟨hal-04877620⟩
4 View
3 Download

Altmetric

Share

More