Using failure information analysis to detect enterprise zombies

Zhaosheng Zhu*, Vinod Yegneswaran, Yan Chen

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contribution

12 Scopus citations


We propose failure information analysis as a novel strategy for uncovering malware activity and other anomalies in enterprise network traffic. A focus of our study is detecting self-propagating malware such as worms and botnets. We begin by conducting an empirical study of transport- and application-layer failure activity using a collection of long-lived malware traces. We dissect the failure activity observed in this traffic in several dimensions, finding that their failure patterns differ significantly from those of real-world applications. Based on these observations, we describe the design of a prototype system called Netfuse to automatically detect and isolate malware-like failure patterns. The system uses an SVM-based classification engine to identify suspicious systems and clustering to aggregate failure activity of related enterprise hosts. Our evaluation using several malware traces demonstrates that the Netfuse system provides an effective means to discover suspicious application failures and infected enterprise hosts. We believe it would be a useful complement to existing defenses.

Original languageEnglish (US)
Title of host publicationSecurity and Privacy in Communication Networks - 5th International ICST Conference, SecureComm 2009, Revised Selected Papers
Number of pages22
StatePublished - 2009
Event5th International ICST Conference on Security and Privacy in Communication Networks, SecureComm 2009 - Athens, Greece
Duration: Sep 14 2009Sep 18 2009

Publication series

NameLecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering
Volume19 LNICST
ISSN (Print)1867-8211


Other5th International ICST Conference on Security and Privacy in Communication Networks, SecureComm 2009

ASJC Scopus subject areas

  • Computer Networks and Communications


Dive into the research topics of 'Using failure information analysis to detect enterprise zombies'. Together they form a unique fingerprint.

Cite this