Analysis of command and control connections using machine learning algorithmsPREMRN, JAKOB (Avtor) Štruc, Vitomir (Mentor) machine learningimbalanced datasetcommand and controlC2C&CZeekRandom forestDecision treeEvery day, more and more people use the Internet. All of these people know how to use the Internet but only a few of them also think about security. The Internet is not much more different from real life. It has safe and dangerous places and there are also criminals who attack Internet users. The only difference between real life attacks and cyber attacks is that in the latter we might not even know we are being attacked. This thesis focuses on one of the attacks in which an adversary gets access to your device and usually uses it for denial-of-service attacks. In denial-of-service attacks adversaries create a huge amount of traffic or requests to a specific server so that the link to the sever becomes congested or its response capabilities are exceeded. This results in the temporarily unresponsiveness of the server. We specifically focus in the research on the connections created between the client and the adversary's server. Our aim is to create a device (a combination of software tools and code) and develop a classification model based on machine learning algorithms which is able to detect such malicious connections. For the research we firstly created a dataset of legitimate and malicious connections captured on port 443. Data was captured using Zeek which is a network monitor and allows real time network traffic capture. The dataset created was in the beginning imbalanced and our first task was to balance it by creating synthetic data samples. In next step we evaluated machine learning algorithms on the dataset we created to determine the optimal algorithm for our classification model. Algorithms were firstly evaluated using Weka and later Python. Evaluation of algorithms showed us that optimal algorithm to use is Decision tree, because it achieved the highest f1-score. The algorithm is able to correctly classify more than 99\% of data samples. Using Decision tree algorithm, a classification model is created using the Decision Tree algorithm and put on top of Zeek which is a network traffic monitor. Our device is implemented in a real environment. The results of the implementation show that there is a large number of misclassifications due to large number of connections, which can present problems. We conclude that the model created performs well with a high classification accuracy but for real life usage it requires an additional input, for example threat intelligence, to filter classification results.20202020-07-09 11:35:00Magistrsko delo/naloga117404VisID: 51181sl