Bortolameotti, R. (author), van Ede, T. (author), Caselli, M. (author), Everts, M.H. (author), Hartel, P. (author), Hofstede, R. (author), Jonker, W. (author), Peter, A. (author) We present DECANTeR, a system to detect anomalous outbound HTTP communication, which passively extracts fingerprints for each application running on a monitored host. The goal of our system is to detect unknown malware and backdoor communication indicated by unknown fingerprints extracted from a host's network traffic. We evaluate a prototype...
conference paper 2017