Network Monitoring Using MMT: An Application Based on the User-Agent Field in HTTP Headers

Despite recent emerging development in intrusion detection or network monitoring, malicious attacks and misbehavior remain a high-risk issue within network traffic. In this paper, we present a proactive solution called MMT (Montimage1 Monitoring Tool) that allows facilitating network security and performance monitoring and operation troubleshooting. We demonstrate the improvements of MMT in comparison with other similar tools. Especially, we assess MMT to deal with a practical case-study in which we analyze the User-Agent field in HTTP headers to determine abnormal activities. Indeed, novel observations figure out the usefulness of the User-Agent field in HTTP requests as a good source to facilitate abnormal activities detection within an abundant traffic. There are eventually several researches alarming the vulnerabilities of the User-Agent field and proposing some manual solution including a combination of tools. However, existing countermeasures are rather passive and do not allow real-time detection. In the context of our research, MMT provides an automated detection of malicious traffic abusing vulnerable User-Agent field. Analyzing abnormal User-Agent strings is also useful to rapidly detect existing evil objects in the network (e.g., bots). The experimental results confirm the improvements of our implementation in comparison with other intrusion detection system (SNORT) and packet analyzing tool (TCPdump).