DEF CON 32 - Signature-Based Detection Using Network Timing - Josh Pyorre

The speaker develops a method to detect and attribute malicious network activity by analyzing time patterns in malware traffic, using techniques like average time intervals, co-integration, and Levenshtein distance to identify behavioral similarities between malware samples, even when they differ in surface-level details. This enables detection of new or evolving threats without requiring full signature matching.

Key Takeaways:
• Attribution and infection chain analysis using malware samples from sources like VirusTotal and any.run, tracking URLs and hashes to map threat actor behaviors 2:00-2:49
• Detection of malicious traffic via network packet analysis, using YARA rules to identify specific post content, user agents, and referrers in HTTP traffic 6:24-7:00
• Use of time-based patterns—average intervals between transactions and timing differences—to distinguish between benign and malicious flows, even across different malware variants 11:00-15:00
• Application of co-integration and Levenshtein distance to compare time-series data from network flows, identifying behavioral similarities between malware campaigns despite differences in execution 16:10-25:00
• Development of a signature-based detection system that converts network transaction timing into audio patterns, enabling potential pattern recognition via tools like Shazam, though currently impractical for production use 35:00-39:00

This research-driven approach leverages behavioral analysis and time-series patterns to detect threats, offering a flexible alternative to traditional signature-based detection.

Sources:

• 2:00-2:49 Attribution and infection chain m