Huynh, Ngoc AnhNgoc AnhHuynhNg, Wee KeongWee KeongNgUlmer, AlexAlexUlmerKohlhammer, JörnJörnKohlhammer2022-03-132022-03-132016https://publica.fraunhofer.de/handle/publica/39434710.1109/VIZSEC.2016.7739581This paper addresses the problem of detecting the presence of malware that leave periodic traces in network traffic. This characteristic behavior of malware was found to be surprisingly prevalent in a parallel study. To this end, we propose a visual analytics solution that supports both automatic detection and manual inspection of periodic signals hidden in network traffic. The detected periodic signals are visually verified in an overview using a circular graph and two stacked histograms as well as in detail using deep packet inspection. Our approach offers the capability to detect complex periodic patterns, but avoids the unverifiability issue often encountered in related work. The periodicity assumption imposed on malware behavior is a relatively weak assumption, but initial evaluations with a simulated scenario as well as a publicly available network capture demonstrate its applicability.enintrusion detectionVisual analyticshistogramsLead Topic: Digitized WorkResearch Line: Human computer interaction (HCI)Research Line: Modeling (MOD)006conference paper