Research Project
Researchers: Edith Cowan University (Managed by) , Matthew Gaber (Associated with) , Michael Johnstone (Associated with) , Mohiuddin Ahmed (Associated with)
Full description
As Peekaboo does not map processes to network flows, there is no PID to flow ground truth, we introduce Construct, a baseline-aware, zero-trust labeling framework for PCAPs. Construct first ingests a baseline capture to establish reference sets, DNS qnames, HTTP hosts, TLS SNIs, and socket endpoints, and grows a conservative benign IP pool only via whitelisted DNS resolutions. During per-file analysis, flows are labeled benign only if they match baseline sets or explicit whitelists; all others are treated as suspicious and escalated. Malicious signals then propagate: resolutions outside the benign pool mark dependent flows as malicious, while beacon-like timing or anomalous HTTP/port usage extend labels across related endpoints. This zero-trust approach reduces false positives while retaining sensitivity, yielding reproducible, explainable flow labels.