Pith. sign in

REVIEW 4 major objections 4 minor 57 references

Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summaries

T0 review · 4 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Contextual summaries let a detector catch APT command-and-control traffic it has never seen

desk verdict Useful extended version of a solid ISC 2022 paper; the real weakness is that the headline 93% mF1 on unseen APTs rests on an asserted-but-unverified platform-invariance assumption, so the numbers likely describe the sandbox corpus better than real enterprise networks. read the letter →

arxiv 2502.05367 v1 pith:JZ3Y7GBY submitted 2025-02-07 cs.CR cs.LGcs.NI

Almuthanna Alageel , Sergio Maffeis , Imperial College London This is my paper · ORCID
classification cs.CRcs.LGcs.NI
keywords APTdetectioncommandandcontrolnetworkintrusionHTTP(S)trafficPairFlowcontextualsummariesrandomforestthreatmodel
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a network intrusion detector can recognize command-and-control (C&C) traffic from Advanced Persistent Threats (APTs) even when the malware family has never been seen during training. The key move is to stop classifying individual flows in isolation and instead build a contextual summary of everything a host does with a remote server over time, across DNS, HTTP(S), and raw TCP behavior. On held-out APT families, the resulting random-forest classifier reports a macro average F1 of 93.02% with a 0.74% false positive rate, and it keeps macro F1 near 93.72% when only opaque HTTPS traffic is visible. If this holds in deployment, organizations could catch APT C&C early without decrypting HTTPS.

What carries the argument

The load-bearing object is PairFlow, a flow format that groups every packet exchanged between one local host and one remote server within a time window, attaches the DNS requests and responses that resolved that server, and records HTTP fields, TLS cipher suites, packet planes, and per-packet timing and lengths. PairFlow is pivoted into host, destination, and URL profiles, and those profiles are merged into a Contextual Summary that is updated across time windows, so the classifier sees the history of a connection, not just one flow. A random forest consumes the Contextual Summary; features such as the mean time difference of sequenced connections (MTDSC), DNS requests per host, destination reached by IP, and resumed connections carry much of the discriminative weight.

What would settle it

Train EarlyCrow exactly as described, run it on packet captures from a real enterprise network with independently confirmed APT infections and manually verified benign traffic, and compare the macro F1 on families not in training; a material drop below the reported 93%, or a showing that platform-specific fields such as TTL dominate the decisions, would falsify the generalization claim.

Watch

Extended reading notes

Core claim

EarlyCrow is a detector for APT malware command and control over HTTP(S). The paper's central claim is that the context surrounding a malicious connection, rather than any single flow feature, separates APT C&C from legitimate web traffic: hosts infected by APTs resolve few domains, keep connections open longer, switch to raw TCP after a camouflage HTTP exchange, contact destinations by IP without DNS resolution, and show timing and byte-ratio patterns distinct from both botnets and benign browsing. The paper encodes that context in PairFlow and Contextual Summaries, and reports that a random forest trained on these summaries detects unseen APT families with a macro F1 of 93.02% and FPR 0.74%, and with macro F1 of 93.72% and accuracy 98.11% in an HTTPS-only mode where HTTP payload features are unavailable.

Load-bearing premise

The headline numbers assume that traffic captured in a public malware sandbox and public repositories behaves like real enterprise APT command-and-control traffic, and the paper does not quantitatively verify that transfer.

Editorial extensions

If this is right

  • Deploying EarlyCrow at the network edge should catch APT families it never saw in training, because the held-out evaluation uses malware families excluded entirely from training.
  • It can flag C&C early, within the first 15 minutes of infection, matching the sandbox observation that C&C contact starts immediately.
  • HTTPS traffic does not need to be decrypted for detection; the HTTPS-mode classifier keeps macro F1 near 93% without plaintext HTTP features.
  • The low FPR of 0.74% means few legitimate flows are interrupted, which matters for operational adoption.
  • PairFlow itself is reusable: it outputs separate JSON variants for FQDN, TCP/UDP/ICMP, HTTP, and HTTPS analysis, not just for this classifier.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: If the sandbox-to-enterprise transfer holds, EarlyCrow-style contextual summaries could be stacked with domain detectors and SIEMs to catch fallback channels that single-flow detectors miss.
  • Editorial inference: The TTP-to-feature correlation analysis suggests a testable extension: evaluating whether the same contextual-summary approach detects the raw-TCP C&C cases (Cases III and IV) that the paper leaves to future work.
  • Editorial inference: Because the paper avoids deep learning due to scarce APT data, a natural next test is whether synthetic augmentation of PairFlow summaries improves generalization further, but this is not shown in the paper.
  • Editorial inference: The reported HTTPS robustness is partly explained by features that survive encryption, such as byte ratios, timing, DNS request counts, and connection resumption; a reader should check whether these survive real-world CDN and proxy traffic.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. EarlyCrow is a network-based detector for APT malware command-and-control (C&C) over HTTP(S). The paper first presents a threat model covering two HTTP(S)-based C&C cases and a set of MITRE ATT&CK TTPs, then introduces PairFlow, a context-preserving flow format that summarizes PCAP traffic into host, destination, URL, and HTTP(S) profiles. A random-forest classifier is trained on a ContextualSummary built from these profiles, using features motivated by a measurement study on APT, botnet, and legitimate traffic. The evaluation uses Any.Run sandbox captures and MCFP/CTU public captures, with experiments on known malware (10 random splits) and on unseen malware families held out from training, in both decrypted HTTP and opaque HTTPS modes. The headline results are a macro average F1 of 93.02% with FPR 0.74% for unseen APTs, and 93.72% mF1 in HTTPS mode.

Significance. If the results hold beyond the specific capture environments, this is a practically relevant contribution: it is one of few APT C&C evaluations on real malware traffic rather than simulated logs, and it comes with public code, datasets, and a clear family-split evaluation. The paper also gives a credible measurement study and a causal-analysis section that shows awareness of dataset bias, which is a strength for this area. The main limitation is external validity: training and test data are drawn from the same two platforms (Any.Run and MCFP/CTU), and the claim that acquisition shift is mitigated is asserted rather than demonstrated. The headline F1 numbers should therefore be read as conditional on the acquisition distribution until invariance is shown.

major comments (4)
  1. [Section VI-B1 and VI-B2] The claim that acquisition shift is mitigated is not backed by an empirical test. Section VI-B1 identifies platform configuration as a confounder and Section VI-B2 states that 'we consider only features with domain-invariant representations to ensure F ⊥⊥ Pf', listing a few dropped features (OS/browser/renderer names, TTL). Since both the training set and the unseen-family test set are drawn from the same Any.Run and MCFP/CTU platforms, a classifier could achieve the reported 93.02% mF1 by exploiting platform artifacts, such as the 15-minute sandbox truncation described in Section III, the single-host destination structure of sandboxed executions, or UA and DNS patterns specific to these capture sources. Please provide a quantitative invariance check, for example: (a) compare feature distributions stratified by platform; (b) train on Any.Run and test on MCFP/CTU and vice versa; or (c) show that the held-out family results are stable when each platform is removed in turn. Without such evidence, the headline 'unseen APT' claim remains an external-validity concern rather than a demonstrated generalization to enterprise traffic.
  2. [Section VII-A, VII-B, Tables V and VI] The reported headline numbers are point estimates without measures of uncertainty. Table V is stated to be the average over ten random splits, but no standard deviation, confidence interval, or per-split range is given; Table VI appears to be a single split. The FPR of 0.74% and the mF1 differences between EarlyCrow and the baseline are therefore not statistically assessable. This matters for the central claim because the unseen-malware evaluation uses a small number of families and, in Table VII, per-malware detection rates are based on very few C&C servers (e.g., Zeus 3 servers, StrongPity 1 server). Please report mean ± std across multiple splits for Table VI, or provide exact binomial confidence intervals for the per-server detection rates, and state the number of test samples per class.
  3. [Section VII, 'HTTPS-Mode' description] The HTTPS-mode experiment is underspecified. The text says that in HTTP mode the NIDS is connected to a web proxy that decrypts HTTPS, while in HTTPS mode it is placed at the network edge 'without deciphering HTTPS', but the paper never defines which features are available in HTTPS mode. Many ContextualSummary features in Table II depend on plaintext HTTP, such as UA strings (features 59-63), HTTP status-code ratios (10-13), content-type ratios (20-26), and URL-based features (82-102). Without an explicit feature-availability mask, the reader cannot tell whether the reported HTTPS mF1 of 93.72% comes from TLS metadata and traffic statistics or from plaintext features that would be unavailable in a real deployment. Please specify exactly which features are dropped or set to missing in HTTPS mode, and if possible validate the mask by comparing against a model that sees only TLS-level fields.
  4. [Section VI-B2, data removal] The exclusion of 'samples without data transfer or failed TCP connections to C&C servers' is not quantified and may bias the malicious class toward easier, data-rich samples. The threat model in Section II explicitly includes fallback channels and low-volume C&C communications, so removing flows with no data transfer could preferentially remove exactly the stealthy cases the system is designed to detect. Please report how many samples and which families were removed by this filter, and provide a sensitivity analysis that includes or re-labels these samples instead of excluding them.
minor comments (4)
  1. [Section IV heading] The heading 'Architecutre Overview' contains a typo; it should read 'Architecture Overview'.
  2. [Figure 7] The legend in Figure 7 uses inconsistent capitalization ('EarlyCrow' versus 'EARLYCROW' in the text and other figures); please unify.
  3. [Section VII-B] The baseline is described only as 'inspired by MADE' with no precise feature list or hyperparameter settings. Since the baseline comparison is used to support the main claim, the configuration should be documented in enough detail to be reproducible.
  4. [Section III and Figure 2] Several statements in the measurement study (e.g., '95.2% of APTs do not exceed a 0.19 DNS ratio') report percentages without sample sizes or confidence intervals; adding these would make the measurement study more interpretable.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: features are fixed before the held-out family evaluation, and self-citations are not load-bearing; the only caveat is an unverified acquisition-shift assumption, an external-validity issue rather than a circular derivation.

full rationale

The paper's derivation chain is self-contained in the relevant sense. EarlyCrow's feature set (Table II) is defined in Section V, before the unseen-malware evaluation in Section VII-B, and the evaluation splits by malware family, holding out families not present in the training set or in the Section III measurement study. No equation-level reduction is present: PairFlow is an input representation, not a function of the label, and the random forest is trained on labeled training data and tested on held-out families. The self-citations (HAWK-EYE [16] and the ISC 2022 extended-version footnote) are contextual and not load-bearing: [16] motivates DNS-domain detection, but EarlyCrow's HTTP(S) features, PairFlow format, and the APT-vs-legitimate evaluation stand independently. The only genuine caveat is the causal-control claim in Section VI-B2 that acquisition shift is mitigated by keeping 'domain-invariant representations' so that F is independent of platform; this is asserted without a quantitative invariance test, meaning the headline 93.02% mF1 may not transfer to enterprise networks. That is an external-validity limitation, not a circular step, because the held-out test labels were not used to construct the features or select the model. Therefore the paper exhibits no significant circularity and receives a score of 0.

Assumptions & free parameters 5 free parameters · 3 assumptions · 0 invented entities

The reported detection performance depends on the unverified representativeness of sandbox-derived training and test captures, on the qualitative claim of domain-invariant features, and on data exclusions that may remove hard-to-detect malicious flows. The random forest hyperparameters, the time-window granularity t, the profile update period ^t, and the SMA parameters are not specified, so part of the reported accuracy could be tied to undisclosed tuning choices.

free parameters (5)
  • Random forest hyperparameters = not reported
    Number of trees, depth, and split criteria are not given; results may depend on these choices.
  • Outlier threshold for SMA (2x) = 2
    Outliers are defined as points two times above the moving average (Section V-B2), a manually chosen constant.
  • SMA sampling rate and window size k = not reported; example k=60
    Section V-B2 gives an example (1-second sampling, k=60) but the actual settings used in experiments are not stated.
  • Granularity t and profile update period ^t = not reported; example t=10 min, ^t=15 min
    Section V-E gives an example configuration but the actual values used for the reported F1 are not given.
  • Observation window (first 15 minutes) = 15 minutes
    All measurements use the first 15 minutes of infection because of the Any.Run sandbox limit (Section III), a dataset-level choice that could affect feature distributions.
assumptions (3)
  • domain assumption Sandbox captures of APT malware for the first 15 minutes are representative of real early-stage APT C&C.
    The entire dataset (APTraces via Any.Run, Section VI-A) and evaluation rest on this; the paper acknowledges acquisition shift (Section VI-B1) but does not validate against real enterprise traffic.
  • domain assumption The remaining features (after dropping TTL, OS, browser) are domain-invariant across platforms.
    Section VI-B2 states 'We consider only features with domain-invariant representations to ensure F ⊥ Pf' without a quantitative invariance test.
  • ad hoc to paper Excluding flows without data transfer or failed TCP connections does not bias the malicious class toward easier samples.
    Section VI-B2 removes these samples as a causal-control measure, but the impact on precision/recall is not measured.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summaries." pith.science (2026). https://pith.science/paper/JZ3Y7GBY

@misc{pith2026250205367,
  author       = {Pith},
  title        = {Pith review of: Detecting APT Malware Command and Control over HTTP(S) Using Contextual Summaries},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JZ3Y7GBY}},
  note         = {Machine review of arXiv:2502.05367}
}
abstract

Advanced Persistent Threats (APTs) are among the most sophisticated threats facing critical organizations worldwide. APTs employ specific tactics, techniques, and procedures (TTPs) which make them difficult to detect in comparison to frequent and aggressive attacks. In fact, current network intrusion detection systems struggle to detect APTs communications, allowing such threats to persist unnoticed on victims' machines for months or even years. In this paper, we present EarlyCrow, an approach to detect APT malware command and control over HTTP(S) using contextual summaries. The design of EarlyCrow is informed by a novel threat model focused on TTPs present in traffic generated by tools recently used as part of APT campaigns. The threat model highlights the importance of the context around the malicious connections, and suggests traffic attributes which help APT detection. EarlyCrow defines a novel multipurpose network flow format called PairFlow, which is leveraged to build the contextual summary of a PCAP capture, representing key behavioral, statistical and protocol information relevant to APT TTPs. We evaluate the effectiveness of EarlyCrow on unseen APTs obtaining a headline macro average F1-score of 93.02% with FPR of $0.74%.

Figures

Figures reproduced from arXiv: 2502.05367 by the authors.

Figure 1
Figure 1. Types of APT malware initial communications. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Measurements for APT, botnets, and legitimate connections. [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Overview of the PAIRFLOW workflow. termination of the TCP connection. For example, when TCP establishes a connection with three-way handshaking, it will summarise SYN, SNYACK, ACK packets as follows (72095, ’0x02’, 215.73 sec, 74),(72126, ’0x12’, 215.78 sec , 70 B), (72127, ’0x10’, 215.78 sec, 66 B). Then it will follow a stream of packets with TCP flag = 0x10 (ACK) until the connection is disconnected with flag FIN… view at source ↗
Figures from the paper (7 more)
Figure 3
Figure 3. Figure 3: FQDN.json includes all domains and their hostname [PITH_FULL_IMAGE:figures/full_fig_p009_3.png]
Figure 4
Figure 4. Figure 4: Overview of the EARLYCROW architecture. or even months. EARLYCROW queries the related info using a host IP, destination IP, and FQDN for Host profile, destination, and URL profile, respectively. The purpose of the host profile is to identify whether that host has a sig…
Figure 5
Figure 5. Figure 5: Causal reasoning relationships [52]. dataset, it is vital to control collider and confounder caused by data shift. The data shift in causal direction can be population, annotation, acquisition shifts, or sample selection bias. Let us assume Z is a vector of the PCAP ra…
Figure 6
Figure 6. Figure 6: Causal model diagram. Empty circles denote hidden [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 7
Figure 7. Figure 7: Effect of using only the top % of features. [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Cumulative distribution of top features gains on the testing set for [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: Heatmap for EARLYCROW-HTTPS. APTs. MADE leverages features related to the communication, HTTP request, response and its content, URL, and UAs. These are used by a random forest classifier to assign a risk score for each connection. As discussed in Section VII, MADE is …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 56 canonical work pages

  1. [1]

    Strategically- motivated advanced persistent threat: Definition, process, tactics and a disinformation model of counterattack,

    A. Ahmad, J. Webb, K. C. Desouza, and J. Boorman, “Strategically- motivated advanced persistent threat: Definition, process, tactics and a disinformation model of counterattack,” vol. 86, pp. 402–418, Elsevier, 2019

    work page 2019

  2. [2]

    Anomaly detection in log data using graph databases and machine learning to defend advanced persistent threats,

    T. Schindler, “Anomaly detection in log data using graph databases and machine learning to defend advanced persistent threats,” in GI- Jahrestagung, 2017

    work page 2017

  3. [3]

    Dark matter: Uncovering the darkcomet rat ecosystem,

    B. Farinholt, M. Rezaeirad, D. McCoy, and K. Levchenko, “Dark matter: Uncovering the darkcomet rat ecosystem,” in Proceedings of The Web Conference (WWW 20) , pp. 2109–2120, 2020

    work page 2020

  4. [4]

    Schrödinger’s RAT: Profiling the stakeholders in the remote access trojan ecosystem,

    M. Rezaeirad, B. Farinholt, H. Dharmdasani, P. Pearce, K. Levchenko, and D. McCoy, “Schrödinger’s RAT: Profiling the stakeholders in the remote access trojan ecosystem,” in 27th USENIX Security Symposium (USENIX Security 18) , pp. 1043–1060, 2018

    work page 2018

  5. [5]

    To catch a ratter: Monitoring the behavior of amateur darkcomet rat operators in the wild,

    B. Farinholt, M. Rezaeirad, P. Pearce, H. Dharmdasani, H. Yin, S. Le Blond, D. McCoy, and K. Levchenko, “To catch a ratter: Monitoring the behavior of amateur darkcomet rat operators in the wild,” in IEEE Symposium on Security and Privacy (S&P 17) , pp. 770–787, IEEE, 2017

    work page 2017

  6. [6]

    Fin7.5: the infamous cybercrime rig “fin7

    M. Heinemeyer, “Fin7.5: the infamous cybercrime rig “fin7” continues its activities.” https://securelist .com/fin7-5-the-infamous-cybercrime- rig-fin7-continues-its-activities/90703//. Accessed: 2021-07-18

    work page 2021

  7. [7]

    Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains,

    E. M. Hutchins, M. J. Cloppert, and R. M. Amin, “Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains,” Leading Issues in Information Warfare & Security Research, vol. 1, no. 1, p. 80, 2011. 20

    work page 2011

  8. [8]

    Holmes: real-time APT detection through correlation of suspicious information flows,

    S. M. Milajerdi, R. Gjomemo, B. Eshete, R. Sekar, and V . Venkatakrish- nan, “Holmes: real-time APT detection through correlation of suspicious information flows,” arXiv preprint arXiv:1810.01594 , 2018

    arXiv 2018

Show all 57 references
  1. [9]

    Botminer: Clustering analysis of network traffic for protocol-and structure-independent botnet detec- tion,

    G. Gu, R. Perdisci, J. Zhang, and W. Lee, “Botminer: Clustering analysis of network traffic for protocol-and structure-independent botnet detec- tion,” in Proceedings of the 17th Conference on Security Symposium (USENIX Security ) , pp. 139–154, 2008

    2008

  2. [10]

    Disclo- sure: detecting botnet command and control servers through large-scale netflow analysis,

    L. Bilge, D. Balzarotti, W. Robertson, E. Kirda, and C. Kruegel, “Disclo- sure: detecting botnet command and control servers through large-scale netflow analysis,” in Proceedings of the 28th Annual Computer Security Applications Conference (ACSAC 12) , pp. 129–138, 2012

    2012

  3. [11]

    Beehive: Large-scale log analysis for detecting suspicious activity in enterprise networks,

    T.-F. Yen, A. Oprea, K. Onarlioglu, T. Leetham, W. Robertson, A. Juels, and E. Kirda, “Beehive: Large-scale log analysis for detecting suspicious activity in enterprise networks,” in Proceedings of the 29th Annual Computer Security Applications Conference (ACSAC 13) , pp. 199–...

    2013

  4. [12]

    Baywatch: robust beaconing detection to identify infected hosts in large-scale enterprise networks,

    X. Hu, J. Jang, M. P. Stoecklin, T. Wang, D. L. Schales, D. Kirat, and J. R. Rao, “Baywatch: robust beaconing detection to identify infected hosts in large-scale enterprise networks,” in 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 16)...

    2016

  5. [13]

    Detection of early-stage enterprise infection by mining large-scale log data,

    A. Oprea, Z. Li, T.-F. Yen, S. H. Chin, and S. Alrwais, “Detection of early-stage enterprise infection by mining large-scale log data,” in Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 15) , pp. 45–56, IEEE, 2015

    2015

  6. [14]

    Behavioral clustering of http-based malware and signature generation using malicious network traces.,

    R. Perdisci, W. Lee, and N. Feamster, “Behavioral clustering of http-based malware and signature generation using malicious network traces.,” in 7th USENIX Symposium on Networked Systems Design and Implementation (NSDI 10) , vol. 10, p. 14, 2010

    2010

  7. [15]

    Applying deep learning on packet flows for botnet detection,

    J. van Roosmalen, H. Vranken, and M. van Eekelen, “Applying deep learning on packet flows for botnet detection,” in Proceedings of the 33rd Annual ACM/SIGAPP Symposium on Applied Computing (SAC 18), pp. 1629–1636, ACM, 2018

    2018

  8. [16]

    H AWK-EYE: Holistic detection of APT command and control domains,

    A. Alageel and S. Maffeis, “H AWK-EYE: Holistic detection of APT command and control domains,” in In The 36th ACM/SIGAPP Sympo- sium on Applied Computing (SAC 21) , pp. 1664–1673, ACM, 2021

    2021

  9. [17]

    Converting information into knowledge-based assets

    D. Burrus, “Converting information into knowledge-based assets.” https://www.burrus.com/2018/08/converting-information-into- knowledge-based-assets/. August 2018

    2018

  10. [18]

    Bro: A system for detecting network intruders in real-time,

    V . Paxson, “Bro: A system for detecting network intruders in real-time,” vol. 31, pp. 2435–2463, Elsevier, 1999

    1999

  11. [19]

    Command and control

    T. M. Corporation, “Command and control.” https://attack .mitre.org/ tactics/TA0011/. Accessed: 2021-12-18

    2021

  12. [20]

    E ARLYCROW github repository

    “E ARLYCROW github repository.” https://github .com/ICL-ml4csec/ EarlyCrowAPT

  13. [21]

    Outside the closed world: On using machine learning for network intrusion detection,

    R. Sommer and V . Paxson, “Outside the closed world: On using machine learning for network intrusion detection,” in IEEE Symposium on Security and Privacy (S&P 10) , pp. 305–316, IEEE, 2010

    2010

  14. [22]

    Fallback channel ttp

    T. M. Corporation, “Fallback channel ttp.” https://attack .mitre.org/ techniques/T1008/. Accessed: 2021-12-18

    2021

  15. [23]

    Protocol tunneling

    T. M. Corporation, “Protocol tunneling.” https://attack .mitre.org/ techniques/T1572/. Accessed: 2021-12-18

    2021

  16. [24]

    Abusing cloud services to fly under the radar

    W. Jansen, “Abusing cloud services to fly under the radar.” https://research.nccgroup.com/2021/01/12/abusing-cloud-services- to-fly-under-the-radar/. Accessed: 2021-12-18

    2021

  17. [25]

    Highly evasive attacker leverages solarwinds supply chain to compromise multiple global victims with sunburst back- door

    FireEye, “Highly evasive attacker leverages solarwinds supply chain to compromise multiple global victims with sunburst back- door.” https://www .mandiant.com/resources/evasive-attacker-leverages- solarwinds-supply-chain-compromises-with-sunburst-backdoor. 2020- 12-13

    2020

  18. [26]

    Application layer protocol: Web protocols

    T. M. Corporation, “Application layer protocol: Web protocols.” https: //attack.mitre.org/techniques/T1071/001/. Accessed: 2021-12-18

    2021

  19. [27]

    Non-application layer protocol

    T. M. Corporation, “Non-application layer protocol.” https://attack.mitre.org/techniques/T1095/. Accessed: 2021-12-18

    2021

  20. [28]

    Encrypted channel

    T. M. Corporation, “Encrypted channel.” https://attack .mitre.org/ techniques/T1573/. Accessed: 2021-12-18

    2021

  21. [29]

    Dynamic resolution: Fast flux dns

    T. M. Corporation, “Dynamic resolution: Fast flux dns.” https:// attack.mitre.org/techniques/T1568/001/. Accessed: 2021-12-18

    2021

  22. [30]

    Data obfuscation: Protocol impersonation

    T. M. Corporation, “Data obfuscation: Protocol impersonation.” https: //attack.mitre.org/techniques/T1001/003/. Accessed: 2021-12-18

    2021

  23. [31]

    Cisco systems netflow services export version 9,

    B. Claise, G. Sadasivan, V . Valluri, and M. Djernaes, “Cisco systems netflow services export version 9,” RFC 3954, October, 2004

    2004

  24. [32]

    Tranalyzer: Versatile high performance network traffic analyser,

    S. Burschka and B. Dupasquier, “Tranalyzer: Versatile high performance network traffic analyser,” in IEEE symposium series on computational intelligence (SSCI 16) , pp. 1–8, IEEE, 2016

    2016

  25. [33]

    Identifying encrypted malware traffic with contextual flow data,

    B. Anderson and D. McGrew, “Identifying encrypted malware traffic with contextual flow data,” in Proceedings of the 2016 ACM workshop on artificial intelligence and security (AISec 16) , pp. 35–46, 2016

    2016

  26. [34]

    Passive dns replication,

    F. Weimer, “Passive dns replication,” in FIRST conference on computer security incident, vol. 98, 2005

    2005

  27. [35]

    Forefront tmg web proxy

    Microsoft, “Forefront tmg web proxy.” https://docs .microsoft.com/en- us/previous-versions/windows/desktop/ff827434(v=vs.85). Accessed: 2021-05-17

    2021

  28. [36]

    Squid: Optimising web delivery

    Squid, “Squid: Optimising web delivery.” http://www .squid-cache.org/. Accessed: 2021-08-20

    2021

  29. [37]

    Dynamic dns

    T. M. Corporation, “Dynamic dns.” https://attack .mitre.org/techniques/ T1568/. Accessed: 2021-12-18

    2021

  30. [38]

    Beyond blacklists: learning to detect malicious web sites from suspicious urls,

    J. Ma, L. K. Saul, S. Savage, and G. M. V oelker, “Beyond blacklists: learning to detect malicious web sites from suspicious urls,” in Proceed- ings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining , pp. 1245–1254, 2009

    2009

  31. [39]

    Made: Security analytics for enterprise threat detection,

    A. Oprea, Z. Li, R. Norris, and K. Bowers, “Made: Security analytics for enterprise threat detection,” in Proceedings of the 34th Annual Computer Security Applications Conference (ACSAC 18) , pp. 124–136, 2018

    2018

  32. [40]

    Optimized invariant representation of network traffic for detecting unseen malware variants,

    K. Bartos, M. Sofka, and V . Franc, “Optimized invariant representation of network traffic for detecting unseen malware variants,” in 25th USENIX Security Symposium (USENIX Security 16), pp. 807–822, 2016

    2016

  33. [41]

    Behavioral classification and detection of malware through http user agent anomalies,

    N. Kheir, “Behavioral classification and detection of malware through http user agent anomalies,” Journal of Information Security and Appli- cations, vol. 18, no. 1, pp. 2–13, 2013

    2013

  34. [42]

    Trafficav: An effective and explainable detection of mobile malware behavior using network traffic,

    S. Wang, Z. Chen, L. Zhang, Q. Yan, B. Yang, L. Peng, and Z. Jia, “Trafficav: An effective and explainable detection of mobile malware behavior using network traffic,” in IEEE/ACM 24th International Sym- posium on Quality of Service (IWQoS 16) , pp. 1–6, IEEE, 2016

    2016

  35. [43]

    Malware detection using http user-agent dis- crepancy identification,

    M. Grill and M. Rehák, “Malware detection using http user-agent dis- crepancy identification,” in IEEE International Workshop on Information Forensics and Security (WIFS) , pp. 221–226, IEEE, 2014

    2014

  36. [44]

    Cipher suite info

    H. C. Rudolph and N. Grundmann, “Cipher suite info.” https:// ciphersuite.info/cs/. Accessed: 2021-06-03

    2021

  37. [45]

    Network traffic behavior analysis by decomposition into control and data planes,

    B. AsSadhan, H. Kim, J. M. Moura, and X. Wang, “Network traffic behavior analysis by decomposition into control and data planes,” in IEEE International Symposium on Parallel and Distributed Processing (IPDPS 08), pp. 1–8, IEEE, 2008

    2008

  38. [46]

    Detecting botnets using command and control traffic,

    B. AsSadhan, J. M. Moura, D. Lapsley, C. Jones, and W. T. Strayer, “Detecting botnets using command and control traffic,” in IEEE 8th International Symposium on Network Computing and Applications (NCA 09), pp. 156–162, IEEE, 2009

    2009

  39. [47]

    Botfinder: Finding bots in network traffic without deep packet inspection,

    F. Tegeler, X. Fu, G. Vigna, and C. Kruegel, “Botfinder: Finding bots in network traffic without deep packet inspection,” in Proceedings of the 8th international conference on Emerging networking experiments and technologies, pp. 349–360, 2012

    2012

  40. [48]

    Nazca: Detecting malware distribution in large-scale networks.,

    L. Invernizzi, S. Miskovic, R. Torres, C. Kruegel, S. Saha, G. Vigna, S.-J. Lee, and M. Mellia, “Nazca: Detecting malware distribution in large-scale networks.,” in The Network and Distributed System Security Symposium (NDSS 14) , vol. 14, pp. 23–26, 2014

    2014

  41. [49]

    From Throw-Away traffic to bots: Detecting the rise of DGA-Based malware,

    M. Antonakakis, R. Perdisci, Y . Nadji, N. Vasiloglou, S. Abu-Nimeh, W. Lee, and D. Dagon, “From Throw-Away traffic to bots: Detecting the rise of DGA-Based malware,” in 21st USENIX Security Symposium (USENIX Security 12) , pp. 491–506, 2012

    2012

  42. [50]

    On botnets that use dns for command and control,

    C. J. Dietrich, C. Rossow, F. C. Freiling, H. Bos, M. Van Steen, and N. Pohlmann, “On botnets that use dns for command and control,” in EC2N, pp. 9–16, IEEE, 2011

    2011

  43. [51]

    Dos and don’ts of machine learning in computer security,

    D. Arp, E. Quiring, F. Pendlebury, A. Warnecke, F. Pierazzi, C. Wress- negger, L. Cavallaro, and K. Rieck, “Dos and don’ts of machine learning in computer security,” in 31st USENIX Security Symposium (USENIX Security 22), 2022

    2022

  44. [52]

    Causality matters in medical imaging,

    D. C. Castro, I. Walker, and B. Glocker, “Causality matters in medical imaging,” Nature Communications, vol. 11, no. 1, pp. 1–10, 2020

    2020

  45. [53]

    Troubleshooting an intrusion detection dataset: the cicids2017 case study,

    G. Engelen, V . Rimmer, and W. Joosen, “Troubleshooting an intrusion detection dataset: the cicids2017 case study,” in IEEE Security and Privacy Workshops (SPW 21) , pp. 7–12, IEEE, 2021

    2021

  46. [54]

    Crafting adversarial example to bypass flow-&ml-based botnet detector via rl,

    J. Wang, L. Qixu, W. Di, Y . Dong, and X. Cui, “Crafting adversarial example to bypass flow-&ml-based botnet detector via rl,” in RAID, pp. 193–204, 2021

    2021

  47. [55]

    Execscent: Mining for new c&c domains in live networks with adaptive control protocol templates,

    T. Nelms, R. Perdisci, and M. Ahamad, “Execscent: Mining for new c&c domains in live networks with adaptive control protocol templates,” in 22nd USENIX Security Symposium (USENIX Security 13) , pp. 589–604, 2013

    2013

  48. [56]

    Decanter: Detection of anomalous outbound http traffic by passive application fingerprinting,

    R. Bortolameotti, T. van Ede, M. Caselli, M. H. Everts, P. Hartel, R. Hofstede, W. Jonker, and A. Peter, “Decanter: Detection of anomalous outbound http traffic by passive application fingerprinting,” in Proceed- 21 ings of the 33rd Annual Computer Security Applications Confer...

    2017

  49. [57]

    Kitsune: an ensemble of autoencoders for online network intrusion detection,

    Y . Mirsky, T. Doitshman, Y . Elovici, and A. Shabtai, “Kitsune: an ensemble of autoencoders for online network intrusion detection,” in The Network and Distributed System Security Symposium (NDSS 18) , 2018. 22

    2018

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.