Skip to main content
Article
Graph-theoretic characterization of cyber-threat infrastructures
Digital Investigation
  • Amine Boukhtouta, Concordia University
  • Djedjiga Mouheb, Concordia University
  • Mourad Debbabi, Concordia University
  • Omar Alfandi, Zayed University
  • Farkhund Iqbal, Zayed University
  • May El Barachi, Zayed University
Document Type
Article
Publication Date
1-1-2015
Abstract

In this paper, we investigate cyber-threats and the underlying infrastructures. More precisely, we detect and analyze cyber-threat infrastructures for the purpose of unveiling key players (owners, domains, IPs, organizations, malware families, etc.) and the relationships between these players. To this end, we propose metrics to measure the badness of different infrastructure elements using graph theoretic concepts such as centrality concepts and Google PageRank. In addition, we quantify the sharing of infrastructure elements among different malware samples and families to unveil potential groups that are behind specific attacks. Moreover, we study the evolution of cyber-threat infrastructures over time to infer patterns of cyber-criminal activities. The proposed study provides the capability to derive insights and intelligence about cyber-threat infrastructures. Using one year dataset, we generate notable results regarding emerging threats and campaigns, important players behind threats, linkages between cyber-threat infrastructure elements, patterns of cyber-crimes, etc.

Publisher
Elsevier Ltd
Disciplines
Keywords
  • Computer crime,
  • Graph theory,
  • Cyber criminals,
  • Cyber threats,
  • Cyber-crimes,
  • Google PageRank,
  • Graph fingerprinting,
  • Graph-theoretic,
  • Malware analysis,
  • Malware families,
  • Malware
Scopus ID

84938975911

Creative Commons License
Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International
Indexed in Scopus
Yes
Open Access
Yes
Open Access Type
Hybrid: This publication is openly available in a subscription-based journal/series
Citation Information
Amine Boukhtouta, Djedjiga Mouheb, Mourad Debbabi, Omar Alfandi, et al.. "Graph-theoretic characterization of cyber-threat infrastructures" Digital Investigation Vol. 14 (2015) p. S3 - S15 ISSN: <p><a href="https://v2.sherpa.ac.uk/id/publication/issn/1742-2876" target="_blank">1742-2876</a></p>
Available at: http://works.bepress.com/omar-alfandi/65/