A cooperative botnet profiling and detection in virtualized environment

Abstract

Abstract-Cloud security becomes an important topic in recent years, as to overcome the botnet in a virtualized environment is a critical task for the cloud providers. Although numerous intrusion detection systems are available, yet it is not practical to install IDS in every virtual machine. In this paper, we argue that a virtual machine monitor (VMM) can support certain security functions that our proposed design can actively collect information directly from the VMM without installing an agent in the guest OS. In addition, bot could not aware of the existence of such detection agent in the VMM. The proposed detection mechanism takes both passive and active detection approaches that the passive detection agent lies in the VMM to examine the tainted data used by a bot to check against bot behavior profiles and the active detection agent that performs active bot fingerprinting can actively send specific stimulus to a guest and examine if there exists expected triggered behavior. In the realworld bot experiments, we show the passive detection agent can distinguish between bots and benign process with low false positive and false negative rates. Also, the result shows the active detection agent can detect a bot even when before it performs its malicious jobs. The proposed mechanism suites an enterprise having cloud environment well to defeat malware.

A Survey on Botnets: Incentives, Evolution, Detection and Current Trends

“…Their study also shows that these bots mostly infect countries in Europe and America. Supporting this is [5], which further proves the effectiveness of behaviourbased detection systems. On a virtual machine (VM), a detection agent is installed, which monitors the processes and their spawned processes to build a behaviour profile and bot process activity log(s).…”

“…At the network level, removal of malware can be performed by agents installed locally or by the use of a continuous communication protocol with a master device. This validates of the integrity of local hosts and allows administrators to perform removal of botnet-enabling malware from hosts, either automatically or manually [5,176,205].…”

“…Very botnet-specific, can introduce additional latency at network edge. [5,84,98,136,176,[201][202][203][204][205]…”

“…A botnet is a network of malware-infected hosts, which are typically controlled by a Command and Control (C&C) server. The C&C server architecture allows for distributed malicious attacks on either the infected hosts or other interconnected hosts over LAN or the internet [5,6]. C&C servers are commonly known as the botmasters, while infected hosts are simply referred to as bots [1].…”

Mobile Botnet Detection Model based on Retrospective Pattern Recognition

“…In contrast, the horizontal similarity index or HSI aims to find similarities amongst different mobile devices activities in a network. The Jaccard Index metric shown in formula 4 is employed by both vertical and horizontal indexes to measure the level of similarities in the history of single device along with similarities of group of mobile devices [26].…”