DARK TRACER AN EARLY DETECTION FRAMEWORK FOR MALWARE ACTIVITY BASED ON ANOMALOUS SPATIOTEMPORAL PATTERNS

Abstract

As cyberattacks become increasingly prevalent globally, there is a need to identify trends in these
cyberattacks and take suitable countermeasures quickly. The darknet, an unused IP address space,
is relatively conducive to observing and analyzing indiscriminate cyberattacks because of the
absence of legitimate communication. Indiscriminate scanning activities by malware to spread their
infections often show similar spatiotemporal patterns, and such trends are also observed on the
darknet. To address the problem of early detection of malware activities, we focus on anomalous
synchronization of spatiotemporal patterns observed in darknet traffic data. Our previous studies
proposed algorithms that automatically estimate and detect anomalous spatiotemporal patterns of
darknet traffic in real time by employing three Independent machine learning methods. In this
study, we integrated the previously proposed methods into a single framework, which we refer to
as Dark-TRACER, and conducted quantitative experiments to evaluate its ability to detect these
malware activities.