Authors: Florian Wiedner, Max Helm, Alexander Daichendt, Jonas Andre, Georg Carle

Authors: Max Helm, Benedikt Jaeger, Georg Carle

Applications often show unique communication behavior. Knowledge about this behavior is beneficial in various use cases, such as anomaly or dependency detection. In this paper, we present network profiles that characterize typical application behavior. This requires a reliable and accurate association of processes and applications, which is challenging. We, therefore, introduce an eBPF-based matcher for this task that enables the creation of network profiles. In our evaluation we show that eBPF allows us to efficiently collect the relevant data to build application profiles, addressing issues of other data collection approaches. We further evaluate our work by using a network profile to identify emulated botnet activity masqueraded as a benign process.

Authors: Lars Wüstrich, Markus Schacherbauer, Markus Budeus, Dominik Freiherr von Künßberg, Sebastian Gallenmüller, Marc-Oliver Pahl, Georg Carle

Authors: Simon Bauer, Patrick Sattler, Johannes Zirngibl, Christoph Schwarzenberg, Georg Carle

Authors: Johannes Naab, Patrick Sattler, Johannes Zirngibl, Stephan Günther, Georg Carle

Authors: Johannes Zirngibl, Patrick Sattler, Georg Carle

Authors: Lion Steger, Liming Kuang, Johannes Zirngibl, Georg Carle, Oliver Gasser

Authors: Benedikt Jaeger, Johannes Zirngibl, Marcel Kempf, Kevin Ploch, Georg Carle

Authors: Henning Stubbe, Sebastian Gallenmüller, Manuel Simon, Eric Hauser, Dominik Scholz, Georg Carle

Authors: Manuel Simon, Sebastian Gallenmüller, Georg Carle