HYMONT, a Hybrid system framework for detecting, classifying, and mitigating Malicious Outbound Network Traffic flows

In Phase I, Milcord LLC and Dartmouth College jointly researched and developed a software prototype that applies machine learning algorithms on contextual metadata, and entropy based sensors for the purpose of detecting data exfiltration on a computer network in real-time while accurately distinguishing between legitimate and anomalous behavior. In particular, we built empirical belief indicators that weigh evidence for and against data exfiltration, stream entropy based indicators that compute the entropy of network protocol features, and conditional entropy among selected features, and Bayesian belief network based classifiers that fuse the outputs of these indicators for data exfiltration decision. We evaluated our sensors by testing them on datasets containing simulated data exfiltration to prove the feasibility of our approach. In Phase II, we propose to build a full-scale flexible prototype that can be applied to not only known covert channels but also to any covert channel that is likely to sprout within the course of our project, evaluate the performance of the developed system using live large scale network traffic data by implementing the developed algorithms on a state of the art parallel supercomputer for near real-time analysis, and on the emerging stream processing engines for real-time detection performance.