cok-zhangziliang / hypervision Goto Github PK

View Code? Open in Web Editor NEW

Flow Interaction Graph based attack traffic detection system.

License: GNU General Public License v3.0

Shell 2.16% C++ 92.64% Python 4.30% CMake 0.90%

hypervision's Introduction

HyperVision

A demo of the flow interaction graph based attack traffic detection system, i.e., HyperVision:

Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow Interaction Graph Analysis
In the $30^{th}$ Network and Distributed System Security Symposium (NDSS'23).
Chuanpu Fu, Qi Li, and Ke Xu.

Please feel free to contact me 😁.

0x00 Hardware

AWS EC2 c4.4xlarge, 100GB SSD, canonical Ubuntu 22.04 LTS (amd64, 3/3/2023).
Tencent Cloud CVM, with similar OS and hardware configurations.

0x01 Software

The demo can be built from a clean Ubuntu env.

# Establish env.
git clone https://github.com/fuchuanpu/HyperVision.git
cd HyperVision
sudo ./env/install_all.sh

# Download dataset.
wget https://hypervision-publish.s3.cn-north-1.amazonaws.com.cn/hypervision-dataset.tar.gz
tar -xxf hypervision-dataset.tar.gz
rm $_

# Build and run HyperVision.
./script/rebuild.sh
./script/expand.sh
cd build && ../script/run_all_brute.sh && cd ..

# Analyze the results.
cd ./result_analyze
./batch_analyzer.py -g brute
cat ./log/brute/*.log | grep AU_ROC
cd -

0x02 Reference

@inproceedings{NDSS23-HyperVision,
  author    = {Chuanpu Fu and
               others},
  title     = {Detecting Unknown Encrypted Malicious Traffic in Real Time via Flow 
               Interaction Graph Analysis},
  booktitle = {NDSS},
  publisher = {ISOC},
  year      = {2023}
}

Recommend Projects