{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T07:19:54Z","timestamp":1790839194421,"version":"4.1.0"},"reference-count":22,"publisher":"Association for Computing Machinery (ACM)","issue":"3","license":[{"start":{"date-parts":[[2019,1,25]],"date-time":"2019-01-25T00:00:00Z","timestamp":1548374400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["SIGMETRICS Perform. Eval. Rev."],"published-print":{"date-parts":[[2019,1,25]]},"abstract":"<jats:p>In recent years, we witness the spreading of a significant variety of malware, which operate and propagate relying on network communications. Due to the staggering growth of traffic in the last years, detecting malicious software has become infeasible on a packet-by-packet basis. In this paper, we address this challenge by investigating malware behaviors and designing a method to detect them relying only on network flow-level data. In our analysis we identify malware types with regards to their impact on a network and the way they achieve their malicious purposes. Leveraging this knowledge, we propose a machine learning-based and privacy-preserving method to detect malware. We evaluate our results on two malware datasets (MalRec and CTU-13) containing traffic of over 65,000 malware samples, as well as one month of network traffic from the University of Oxford containing over 23 billion flows. We show that despite the coarse-grained information provided by network flows and the imbalance between legitimate and malicious traffic, MalAlert can distinguish between different types of malware with the F1 score of 90%.<\/jats:p>","DOI":"10.1145\/3308897.3308961","type":"journal-article","created":{"date-parts":[[2019,1,28]],"date-time":"2019-01-28T14:01:39Z","timestamp":1548684099000},"page":"151-154","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":28,"title":["MalAlert"],"prefix":"10.1145","volume":"46","author":[{"given":"Michal","family":"Piskozub","sequence":"first","affiliation":[{"name":"University of Oxford, Oxford, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Riccardo","family":"Spolaor","sequence":"additional","affiliation":[{"name":"University of Oxford, Oxford, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ivan","family":"Martinovic","sequence":"additional","affiliation":[{"name":"University of Oxford, Oxford, United Kingdom"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2019,1,25]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Challenges in Experimenting with Botnet Detection Systems. In USENIX CSET","year":"2011","unstructured":"A. J. A. et al . Challenges in Experimenting with Botnet Detection Systems. In USENIX CSET , 2011 . A. J. A. et al. Challenges in Experimenting with Botnet Detection Systems. In USENIX CSET, 2011."},{"key":"e_1_2_1_2_1","volume-title":"CHATTER: Classifying Malware Families Using System Event Ordering. In CNS","year":"2014","unstructured":"A. M. et al . CHATTER: Classifying Malware Families Using System Event Ordering. In CNS , 2014 . A. M. et al. CHATTER: Classifying Malware Families Using System Event Ordering. In CNS, 2014."},{"key":"e_1_2_1_3_1","volume-title":"et al. MalClassifier: Malware Family Classification Using Network Flow Sequence Behaviour. In eCrime","year":"2018","unstructured":"B. A. A. et al. MalClassifier: Malware Family Classification Using Network Flow Sequence Behaviour. In eCrime , 2018 . B. A. A. et al. MalClassifier: Malware Family Classification Using Network Flow Sequence Behaviour. In eCrime, 2018."},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2016.2636078"},{"key":"e_1_2_1_5_1","volume-title":"BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation. In USENIX Security","year":"2007","unstructured":"G. G. et al . BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation. In USENIX Security , 2007 . G. G. et al. BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation. In USENIX Security, 2007."},{"key":"e_1_2_1_6_1","volume-title":"BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection. In USENIX Security","year":"2008","unstructured":"G. G. et al . BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection. In USENIX Security , 2008 . G. G. et al. BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection. In USENIX Security, 2008."},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-008-0086-0"},{"key":"e_1_2_1_8_1","volume-title":"MalRec: Compact Full-Trace Malware Recording for Retrospective Deep Analysis. In DIMVA","year":"2018","unstructured":"G. S. et al . MalRec: Compact Full-Trace Malware Recording for Retrospective Deep Analysis. In DIMVA , 2018 . G. S. et al. MalRec: Compact Full-Trace Malware Recording for Retrospective Deep Analysis. In DIMVA, 2018."},{"key":"e_1_2_1_9_1","volume-title":"Portscan Detection with Sampled NetFlow. In TMA","year":"2009","unstructured":"I. P.-O. et al . Portscan Detection with Sampled NetFlow. In TMA , 2009 . I. P.-O. et al. Portscan Detection with Sampled NetFlow. In TMA, 2009."},{"key":"e_1_2_1_10_1","volume-title":"BotTrack: Tracking Botnets Using NetFlow and PageRank. In NETWORKING","year":"2011","unstructured":"J. F. et al . BotTrack: Tracking Botnets Using NetFlow and PageRank. In NETWORKING , 2011 . J. F. et al. BotTrack: Tracking Botnets Using NetFlow and PageRank. In NETWORKING, 2011."},{"key":"e_1_2_1_11_1","volume-title":"Optimized Invariant Representation of Network Traffic for Detecting Unseen Malware Variants. In USENIX Security","year":"2016","unstructured":"K. B. et al . Optimized Invariant Representation of Network Traffic for Detecting Unseen Malware Variants. In USENIX Security , 2016 . K. B. et al. Optimized Invariant Representation of Network Traffic for Detecting Unseen Malware Variants. In USENIX Security, 2016."},{"key":"e_1_2_1_12_1","volume-title":"DISCLOSURE: Detecting Botnet Command and Control Servers Through Large-Scale NetFlow Analysis. In ACSAC","year":"2012","unstructured":"L. B. et al . DISCLOSURE: Detecting Botnet Command and Control Servers Through Large-Scale NetFlow Analysis. In ACSAC , 2012 . L. B. et al. DISCLOSURE: Detecting Botnet Command and Control Servers Through Large-Scale NetFlow Analysis. In ACSAC, 2012."},{"key":"e_1_2_1_13_1","volume-title":"Detection of SSH Brute Force Attacks Using Aggregated NetFlow Data. In ICMLA","year":"2015","unstructured":"M. M. N. et al . Detection of SSH Brute Force Attacks Using Aggregated NetFlow Data. In ICMLA , 2015 . M. M. N. et al. Detection of SSH Brute Force Attacks Using Aggregated NetFlow Data. In ICMLA, 2015."},{"key":"e_1_2_1_14_1","volume-title":"AVClass: A Tool for Massive Malware Labeling. In RAID","year":"2016","unstructured":"M. S. et al . AVClass: A Tool for Massive Malware Labeling. In RAID , 2016 . M. S. et al. AVClass: A Tool for Massive Malware Labeling. In RAID, 2016."},{"key":"e_1_2_1_15_1","volume-title":"FIRMA: Malware Clustering and Network Signature Generation with Mixed Network Behaviors. In RAID","year":"2013","unstructured":"M. Z. R. et al . FIRMA: Malware Clustering and Network Signature Generation with Mixed Network Behaviors. In RAID , 2013 . M. Z. R. et al. FIRMA: Malware Clustering and Network Signature Generation with Mixed Network Behaviors. In RAID, 2013."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-02937-5_9"},{"issue":"2","key":"e_1_2_1_17_1","first-page":"139","volume":"3","year":"2014","unstructured":"P. A. . Botnet Detection Using NetFlow and Clustering. ACSIJ , 3 ( 2 ): 139 -- 149 , 2014 . P. A. et al. Botnet Detection Using NetFlow and Clustering. ACSIJ, 3(2):139--149, 2014.","journal-title":"Botnet Detection Using NetFlow and Clustering. ACSIJ"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/2677046.2677050"},{"key":"e_1_2_1_19_1","volume-title":"Behavioral Clustering of HTTP-based Malware and Signature Generation Using Malicious Network Traces. In USENIX NSDI","year":"2010","unstructured":"R. P. et al . Behavioral Clustering of HTTP-based Malware and Signature Generation Using Malicious Network Traces. In USENIX NSDI , 2010 . R. P. et al. Behavioral Clustering of HTTP-based Malware and Signature Generation Using Malicious Network Traces. In USENIX NSDI, 2010."},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"e_1_2_1_21_1","volume-title":"Trafficc Aggregation for Malware Detection. In DIMVA","year":"2008","unstructured":"T. F. Y. et al . Trafficc Aggregation for Malware Detection. In DIMVA , 2008 . T. F. Y. et al. Trafficc Aggregation for Malware Detection. In DIMVA, 2008."},{"key":"e_1_2_1_22_1","volume-title":"TSP","year":"2016","unstructured":"V. O. et al. Modeling Botnet C&C Traffic Lifespans from NetFlow Using Survival Analysis . In TSP , 2016 . V. O. et al. Modeling Botnet C&C Traffic Lifespans from NetFlow Using Survival Analysis. In TSP, 2016."}],"container-title":["ACM SIGMETRICS Performance Evaluation Review"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3308897.3308961","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3308897.3308961","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T00:58:03Z","timestamp":1750208283000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3308897.3308961"}},"subtitle":["Detecting Malware in Large-Scale Network Traffic Using Statistical Features"],"short-title":[],"issued":{"date-parts":[[2019,1,25]]},"references-count":22,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2019,1,25]]}},"alternative-id":["10.1145\/3308897.3308961"],"URL":"https:\/\/doi.org\/10.1145\/3308897.3308961","relation":{},"ISSN":["0163-5999"],"issn-type":[{"value":"0163-5999","type":"print"}],"subject":[],"published":{"date-parts":[[2019,1,25]]},"assertion":[{"value":"2019-01-25","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}