A Rule-based Approach to Detect Botnets based on DNS

Alieyan, Kamal; Almomani, Ammar; Abdullah, Rosni; Anbar, Mohammed

doi:10.1109/iccsce.2018.8684959

Cited by 3 publications

(4 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…15. Many researchers adopted these evaluation metrics in their work (Soltanaghaei & Kharrazi, 2015;Kwon et al, 2016;Alieyan, 2018;Shi & Sun, 2020).…”

Section: Resultsmentioning

confidence: 99%

“…Since the bot or botnet tries to connect with the botmaster in different predefined periods, the average entropy for the source IP is essential to distinguish between benign and malicious traffic. Furthermore, we use the same time value, 5 s, for flow analysis based on a previous study (Alieyan, 2018). Equation (2) calculates the average domain entropy feature (F1).…”

Section: Enriched Features Calculations (Feature Engineering) Stepmentioning

confidence: 99%

“…Furthermore, the dataset is presented as a grouped aggregated flow. For a unified grouped aggregated flow time during the calculation of the computed features, the predefined time used for each calculated group is 5 s based on previous studies (Alieyan, 2018;Qi et al, 2018). Additionally, by aggregating the flow in a fixed interval of 5 s, the dataset size and the processing time are reduced.…”

Section: Building Training Dataset Stepmentioning

confidence: 99%

See 2 more Smart Citations

Hybrid rule-based botnet detection approach using machine learning for analysing DNS traffic

Al-Mashhadi

Anbar

Hasbullah

et al. 2021

PeerJ Computer Science

Self Cite

View full text Add to dashboard Cite

Botnets can simultaneously control millions of Internet-connected devices to launch damaging cyber-attacks that pose significant threats to the Internet. In a botnet, bot-masters communicate with the command and control server using various communication protocols. One of the widely used communication protocols is the ‘Domain Name System’ (DNS) service, an essential Internet service. Bot-masters utilise Domain Generation Algorithms (DGA) and fast-flux techniques to avoid static blacklists and reverse engineering while remaining flexible. However, botnet’s DNS communication generates anomalous DNS traffic throughout the botnet life cycle, and such anomaly is considered an indicator of DNS-based botnets presence in the network. Despite several approaches proposed to detect botnets based on DNS traffic analysis; however, the problem still exists and is challenging due to several reasons, such as not considering significant features and rules that contribute to the detection of DNS-based botnet. Therefore, this paper examines the abnormality of DNS traffic during the botnet lifecycle to extract significant enriched features. These features are further analysed using two machine learning algorithms. The union of the output of two algorithms proposes a novel hybrid rule detection model approach. Two benchmark datasets are used to evaluate the performance of the proposed approach in terms of detection accuracy and false-positive rate. The experimental results show that the proposed approach has a 99.96% accuracy and a 1.6% false-positive rate, outperforming other state-of-the-art DNS-based botnet detection approaches.

show abstract

“…15. Many researchers adopted these evaluation metrics in their work (Soltanaghaei & Kharrazi, 2015;Kwon et al, 2016;Alieyan, 2018;Shi & Sun, 2020).…”

Section: Resultsmentioning

confidence: 99%

Section: Enriched Features Calculations (Feature Engineering) Stepmentioning

confidence: 99%

Section: Building Training Dataset Stepmentioning

confidence: 99%

See 1 more Smart Citation

Hybrid rule-based botnet detection approach using machine learning for analysing DNS traffic

Al-Mashhadi

Anbar

Hasbullah

et al. 2021

PeerJ Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…Botnets for example are used for launching attacks of distributed denial-of-service (DDoS). They are used for identifying thefts, sending spam and phishing emails (Ammar et al, 2018;Almomani et al, 2015Almomani et al, , 2013Almomani, 2018;Alieyan et al, 2018;Alauthaman et al, 2018;Alauthman et al, 2020;Alieyan et al, 2019;Al-Kasassbeh et al, 2020;Alauthman and Albesani, 2019;Al-Nawasrah et al, 2020). Fast flux networks (FFNs) serve as a kind of botnet.…”

Section: Introductionmentioning

confidence: 99%

Botnet detection used fast-flux technique, based on adaptive dynamic evolving spiking neural network algorithm

Almomani

Nawasrah

Meziane

et al. 2021

IJAHUC

Self Cite

View full text Add to dashboard Cite

A botnet refers to a group of machines. These machines are controlled distantly by a specific attacker. It represents a threat facing the web and data security. Fast-flux service network (FFSN) has been engaged by bot herders for cover malicious botnet activities. It has been engaged by bot herders for increasing the lifetime of malicious servers through changing the IP addresses of the domain name quickly. In the present research, we aimed to propose a new system. This system is named fast flux botnet catcher system (FFBCS). This system can detect FF-domains in an online mode using an adaptive dynamic evolving spiking neural network algorithm. Comparing with two other related approaches the proposed system shows a high level of detection accuracy, low false positive and negative rates, respectively. It shows a high performance. The algorithm's proposed adaptation increased the accuracy of the detection. For instance, this accuracy reached (98.76%) approximately.

show abstract

The Risk of Botnets in Cyber Physical Systems

Derakhshan

Ashrafnejad

2020

Security of Cyber-Physical Systems

View full text Add to dashboard Cite

A Rule-based Approach to Detect Botnets based on DNS

Cited by 3 publications

References 22 publications

Hybrid rule-based botnet detection approach using machine learning for analysing DNS traffic

Hybrid rule-based botnet detection approach using machine learning for analysing DNS traffic

Botnet detection used fast-flux technique, based on adaptive dynamic evolving spiking neural network algorithm

The Risk of Botnets in Cyber Physical Systems

Contact Info

Product

Resources

About