Empirical Evaluation of Information Leakage Detection Using Net-flow Analysis  

作　　者：Jing Xu Fei Xu Xiao-Jun Chen Jin-Qiao Shi Cheng Qi 

机构地区：[1]Institute of Information Engineering,Chinese Academy of Sciences [2]Dept.of Computer Science,Beijing University of Technology

出　　处：《Journal of Harbin Institute of Technology(New Series)》2014年第6期16-21,共6页哈尔滨工业大学学报（英文版）

基　　金：Sponsored by the National Natural Science Foundation of China(Grant No.61272500);the National High Technology Research and Development Program of China(Grant No.2011AA010701)

摘　　要：Because of the widespread of Trojans,organizations and Internet users become more vulnerable to the threat of information leakage.This paper describes an information leakage detection system( ILDS) to detect sensitive information leakage caused by Trojan.In particular,the principles of the system are based on the analysis of net-flows in four perspectives: heartbeat behavior analysis,DNS abnormal analysis,uploaddownload ratio and content analysis.Heartbeat behavior analysis and DNS abnormal analysis are used to detect the existence of Trojans while upload-download ratio and content analysis can quickly detect when the information leakage happens.Experiments indicate that the system is reliable and efficient in detecting information leakage.The system can also help to collect and preserve digital evidence when information leakage incident occurs.Because of the widespread of Trojans,organizations and Internet users become more vulnerable to the threat of information leakage.This paper describes an information leakage detection system（ ILDS） to detect sensitive information leakage caused by Trojan.In particular,the principles of the system are based on the analysis of net-flows in four perspectives： heartbeat behavior analysis,DNS abnormal analysis,uploaddownload ratio and content analysis.Heartbeat behavior analysis and DNS abnormal analysis are used to detect the existence of Trojans while upload-download ratio and content analysis can quickly detect when the information leakage happens.Experiments indicate that the system is reliable and efficient in detecting information leakage.The system can also help to collect and preserve digital evidence when information leakage incident occurs.

关 键 词：information leakage heartbeat behavior Trojan detection digital forensics 

分 类 号：TP391.7[自动化与计算机技术—计算机应用技术]