{"id":1683,"date":"2022-04-01T10:42:06","date_gmt":"2022-04-01T10:42:06","guid":{"rendered":"https:\/\/sappan-project.eu\/?p=1683"},"modified":"2022-04-01T14:51:07","modified_gmt":"2022-04-01T14:51:07","slug":"modeling-host-behavior-in-computer","status":"publish","type":"post","link":"https:\/\/sappan-project.eu\/?p=1683","title":{"rendered":"Modeling Host Behavior in Computer Network"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

By Tomas Jirsik (Institute of Computer Science, Masaryk University) <\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
An analysis of a host behavior is an essential key for modern network management and security. A robust behavior profile enables the network managers to detect anomalies with high accuracy, predict the host behavior, or group host to clusters for better management. This blog introduces basic features for host behavior that can be obtained from network traffic and provides initial insights into long-term host behavior gained by analysis of host behavior over one year. <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n

Network traffic monitoring is a rich source of information on host <\/span>behavior. The passive large-scale approaches to traffic monitoring, such as network flow monitoring [1], enable us to observe a <\/span><\/span><\/span>behavior<\/span><\/span><\/span> of a large number of hosts in a network without the necessity to have direct access to these hosts. Current network monitoring approaches can provide information on each connection, even in high-speed networks, without any sampling. <\/span><\/span> <\/span><\/p>\n<\/div>\n

\n

The data retrieved by network monitoring tools from network traffic represents individual connections (either one- or bi-directional). However, these network connections need to be transformed into features properly embedding the hosts <\/span><\/span><\/span>behavior<\/span><\/span><\/span>. Table 1 presents the basic features that can be extracted from the network connection records provided by a majority of<\/span> <\/span>the network monitoring tools.  <\/span><\/span><\/p>\n<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
Table 1: Features for modeling host behavior <\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The models of host behavior<\/span> can capture various aspects of host <\/span>behavior<\/span><\/span>. A commonly <\/span>modeled <\/span>behavior<\/span><\/span> element includes temporal characteristics of the <\/span>behavior<\/span><\/span>, volumetric nature of the <\/span>behavior<\/span><\/span>, and last but not least, the usual habits of a user such as frequently visited domains, AS, or countries. More advanced analyses of the host <\/span>behavior<\/span><\/span> can focus on the identification of the stability of the host <\/span>behavior<\/span><\/span>, anomaly detection, <\/span>behavior<\/span><\/span> change <\/span>d<\/span>etection, or host clustering.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
Figure 1: Analysis of the temporal patterns of host behaviors.<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n

Figure 1 provides an example of the analysis of active communication times for hosts in different types of subnets in a network over a year. A line in the figure represents a share of a single host’s active observations in a year. The diurnal pattern with the peak at noon and a smaller peak at 3 AM are present in the segment containing mainly work stations of regular workers (SUB_WORK). The peak culminating at noon represents the typical daylight activity. The smaller peak at 3 AM is caused by the updates of the workstations planned by the central management system. Similarly, the weekday pattern is observable at the SUB_WORK, which reflects the fact that the majority of the hosts in the SUB_WORK subnets are used by the employees of the university. Hosts in the server segment (SUB_SERV), on the other hand, do not show any significant diurnal pattern.<\/span><\/span> <\/span><\/p>\n<\/div>\n

\n

Modeling the stability of the host <\/span><\/span>behavior<\/span><\/span><\/span> aims to identify hosts with unstable (i.e., irregular, more random) and differentiate them from the hosts that behave consistently in time. We can then work with the assumption that the hosts with consistent <\/span><\/span>behavior<\/span><\/span><\/span> in time usually pose a lower risk and do not be monitored in greater detail compared to the hosts with inconsistent <\/span><\/span>behavior<\/span><\/span><\/span>. The figures below present selected use-cases that can be identified using the host <\/span><\/span>behavior<\/span><\/span><\/span> models derived from their network <\/span><\/span>behavior<\/span><\/span>.<\/span><\/span><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
Figure 2: Model based on # of Flows can identify behavior change in traffic volume of a host, (a) behavior of a host over a year, (b) modeled week profiles of the host. <\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
Figure 3: Model based on # of Flows can identify behavior change in active times. From January to March, the host communicates only in working hours, while from May, the hosts start communicating 24\/7.<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
Figure 4: A suspicious behavior of a host indicating outgoing horizontal scanning in one week in a year (multiple connections on multiple hosts without the increase in a number of different ports contacted). <\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

CONCLUSION<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The examples shown in the blog provide only a glimpse of the possibilities of modeling<\/span> the host <\/span>behavior<\/span><\/span> based on the data captured from network traffic. The <\/span>host <\/span>behavior<\/span><\/span> modeling<\/span> can be efficiently applied in various areas of network management, such as network segmentation, network policies settings, or even cybersecurity incident prioritization. All examples presented in the blog are explained and described in detail in [2], along with an open-source dataset of one-year host <\/span>behavior<\/span><\/span> data available on a public repository.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
References:<\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n

[<\/span>1<\/span>]: <\/span>R. Hofstede\u202f<\/span><\/span>et al<\/span><\/span>., “Flow Monitoring Explained: From Packet Capture to Data Analysis <\/span>With NetFlow and IPFIX,” in\u202f<\/span><\/span>IEEE Communications Surveys & Tutorials<\/span><\/span>, vol. 16, no. 4, pp. 2037-2064, Fourthquarter 2014, doi: 10.1109\/COMST.2014.2321898.<\/span><\/span> <\/span><\/p>\n<\/div>\n

\n

<\/span> <\/span>
<\/span>[2]: <\/span>T. Jirsik<\/span> and P. <\/span>Velan<\/span>, “Host <\/span><\/span>Behavior<\/span><\/span><\/span> in Computer Network: One-Year Study,” in IEEE Transactions on Network and Service Management, vol. 18, no. 1, pp. 822-838, March 2021, <\/span>doi: 10.1109\/TNSM.2020.3036528.<\/span><\/span> <\/span><\/p>\n<\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
About the author(s): <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Tomas Jirsik<\/span> received the Ph.D. degree in informatics<\/span> <\/span>from the Faculty of Informatics, Masaryk<\/span> <\/span>University, Czech Republic. He is currently a<\/span> <\/span>Senior Researcher with the Institute of Computer<\/span> <\/span>Science, Masaryk University and a Member of<\/span> <\/span>the Computer Security Incident Response Team,<\/span> <\/span>Masaryk University, where he leads national and<\/span> <\/span>international research projects on cybersecurity. His<\/span> <\/span>research focus lies on the network traffic analysis<\/span> <\/span>with a specialization in host profiling. His research<\/span> <\/span>further includes network segmentation approaches<\/span> <\/span>via machine learning and host fingerprinting in network traffic.<\/span><\/span> <\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>