Real-Time IRC Threat Detection Framework

Sicong Shao, Cihan Tunc, Pratik Satam, Salim A Hariri

Research output: Chapter in Book/Report/Conference proceedingConference contribution

9 Scopus citations

Abstract

Most of the social media platforms generate a massive amount of raw data that is slow-paced. On the other hand, Internet Relay Chat (IRC) protocol, which has been extensively used by hacker community to discuss and share their knowledge, facilitates fast-paced and real-Time text communications. Previous studies of malicious IRC behavior analysis were mostly either offline or batch processing. This results in a long response time for data collection, pre-processing, and threat detection. However, since the threats can use the latest vulnerabilities to exploit systems (e.g. zero-day attack) and which can spread fast using IRC channels. Current IRC channel monitoring techniques cannot provide the required fast detection and alerting. In this paper, we present an alternative approach to overcome this limitation by providing real-Time and autonomic threat detection in IRC channels. We demonstrate the capabilities of our approach using as an example the shadow brokers' leak exploit (the exploit leveraged by WannaCry ransomware attack) that was captured and detected by our framework.

Original languageEnglish (US)
Title of host publicationProceedings - 2017 IEEE 2nd International Workshops on Foundations and Applications of Self* Systems, FAS*W 2017
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages318-323
Number of pages6
ISBN (Electronic)9781509065585
DOIs
StatePublished - Oct 9 2017
Event2nd IEEE International Workshops on Foundations and Applications of Self* Systems, FAS*W 2017 - Tucson, United States
Duration: Sep 18 2017Sep 22 2017

Other

Other2nd IEEE International Workshops on Foundations and Applications of Self* Systems, FAS*W 2017
CountryUnited States
CityTucson
Period9/18/179/22/17

Keywords

  • cyber security
  • hacker data analysis and visualization
  • Internet Relay Chat (IRC)
  • real-Time threat detection
  • Stanford coreNLP
  • WannaCry ransomware attack

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Hardware and Architecture
  • Computational Mechanics

Fingerprint Dive into the research topics of 'Real-Time IRC Threat Detection Framework'. Together they form a unique fingerprint.

  • Cite this

    Shao, S., Tunc, C., Satam, P., & Hariri, S. A. (2017). Real-Time IRC Threat Detection Framework. In Proceedings - 2017 IEEE 2nd International Workshops on Foundations and Applications of Self* Systems, FAS*W 2017 (pp. 318-323). [8064142] Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/FAS-W.2017.166