A Collaborative Approach to Botnet Protection

Abstract

Abstract. Botnets are collections of compromised computers which have come under the control of a malicious person or organisation via malicious software stored on the computers, and which can then be used to interfere with, misuse, or deny access to a wide range of Internet-based services. With the current trend towards increasing use of the Internet to support activities related to banking, commerce, healthcare and public administration, it is vital to be able to detect and neutralise botnets, so that these activities can continue unhindered. In this paper we present an overview of existing botnet detection techniques and argue why a new, composite detection approach is needed to provide efficient and effective neutralisation of botnets. This approach should combine existing detection efforts into a collaborative botnet protection framework that receives input from a range of different sources, such as packet sniffers, on-access anti-virus software and behavioural analysis of network traffic, computer sub-systems and application programs. Finally, we introduce ContraBot, a collaborative botnet detection framework which combines approaches that analyse network traffic to identify patterns of botnet activity with approaches that analyse software to detect items which are capable of behaving maliciously.

Collaborative Security

“…However, BotMosaic [Houmansadr and Borisov 2012a] is impressive to interpolate network traffic and then track the bots by proliferation with collaboration. Wang and Gong [2009], Tseng et al [2011], and Stevanovic et al [2012] employ both approaches and largely focus on the collaboration to raise the accuracy of detection. As shown in Figure 2, host anomalies and network traffic (denoted as message 1 ) can be captured by the detection unit and sent to the collaboration unit for further detection.…”

“…The central server will process, aggregate, and correlate these logs, and detect some potential attacks. In other literature [Wong 2006;Agarwal et al 2010;Oliner et al 2012;Stevanovic et al 2012], offline analysis is conducted while nodes are continuing their job without being blocked by the analysis results.…”

“…In Schmidt et al [2009], each mobile phone first carries out static ELF analysis then extracts feature vectors from the output to share. ContraBot [Stevanovic et al 2012] is one of typical botnet detection systems that filters and preprocesses feature data in advance to improve effectiveness and scalability.…”

Hybrid rule-based botnet detection approach using machine learning for analysing DNS traffic

“…Nowadays, especially during the global COVID-19 pandemic, there is no longer a debate that the Internet has become a core element of our daily life. Today's Internet is about online presence, e-learning, social media, e-banking, work from home, online shopping, Internet of Things, and cloud computing (Stevanovic et al, 2012;Nozomi Networks Labs, 2020;Lallie et al, 2020). Unfortunately, Internet resources are continuously under threat by malicious actors, whether individual or organised entities.…”

Botnet detection using ensemble classifiers of network flow

“…Day by day the dependency on the Internet has increased in our daily lives, mainly in many important fields such as educational organizations, communication companies, government facilities, banking, and e-commerce. This adds many difficulties in managing the web and utilizing the application, for example, protecting the user data, integrity, privacy, and availability [1]. All these reasons changed the consideration of attackers to thinking about financial advantages, the attackers utilize diverse malware to accomplish their objectives.…”