An approach for host based botnet detection system

Aleksieva, Y.; Valchanov, Hristo; Aleksieva, Veneta

doi:10.1109/elma.2019.8771644

Cited by 14 publications

(6 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The highest total for the type of centered communication behaviors is performed in DDoS activity. Is considering the purpose of the attack is to flood the target [2,8,9,28]. In addition, bots like Nerris in Scenario number 9 do much communication, with fourteen thousands of the total targets.…”

Section: Communication Behaviormentioning

confidence: 99%

“…A botnet consists of a collection of computers that have been infected and forms a network communication [3][4][5][6]. Infected computers are known as bots or zombies and are controlled by botmaster [4,[6][7][8] that communicate to bot-client via a communication channel [3,9] to attack a computer target. Bot's malicious activities can be in the form of distributed denial of service (DDoS), spreading malware, phishing, sending spam messages, and misrepresentation of multi-layer adaptive clicks [1,[10][11][12][13].…”

Section: Introductionmentioning

confidence: 99%

“…Bot's malicious activities can be in the form of distributed denial of service (DDoS), spreading malware, phishing, sending spam messages, and misrepresentation of multi-layer adaptive clicks [1,[10][11][12][13]. Botnets use a command & control (C&C) structure in carrying out all their activities [3][4][5][6][7][8][9]14], including communication between bots and botmasters in sending commands and updating code from the botnet control system [4,8].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Analysis of Botnet Attack Communication Pattern Behavior on Computer Networks

2022

IJIES

View full text Add to dashboard Cite

Botnets are a severe threat to a computer network, affecting various aspects of security systems, including spreading malicious programs, phishing, sending spam messages, and click fraud. Because of their negative consequences, botnets must be identified early. Nevertheless, their different characteristics have made them challenging to detect. This research proposes a bot patterns communication detection from traffic flows analysis consisting of three main activities: bot detection, extraction, and communication behavior analysis phases. This proposed model aims to obtain a specific behavior of bot attacks, which can be used as an early warning bots attack system. The process of bot patterns communication detection depends on the accuracy of bot detection, so the model improves the pre-processing phase and uses multi-model classification. Improvement in the pre-processing phase is carried out in the feature engineering section using the concept of one-hot encoding. Several machine learning classification models are used to obtain the best detection accuracy: Decision tree, Random forest, Logistic regression, k-NN, and Naïve Bayes. Furthermore, the model has been tested on two different datasets, namely the NCC and CTU-13. The experimental results show that the proposed model is optimal and recognizes bot activities well. The accuracy detection is obtained at 99.99%. Besides, the model can also identify the bot's attack activity scenario and communication behavior in three types: centralized, distributed, and spread.

show abstract

Section: Communication Behaviormentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Analysis of Botnet Attack Communication Pattern Behavior on Computer Networks

2022

IJIES

View full text Add to dashboard Cite

show abstract

“…In the first group, GAs with binary coding were studied [10] - [11]. In the second group, respectively, GAs with valid coding [12] - [13]. In [12], it was shown that in the first group it is possible to achieve higher efficiency of searching for extreme values on the set of feasible solutions.…”

Section: Review and Analysis Of Previous Studiesmentioning

confidence: 99%

Decision Support System on Optimization of Information Protection Tools Placement

A¹

2020

IJATCSE

View full text Add to dashboard Cite

The article discusses the possibilities of modifying the genetic algorithm (GA) to solve the problem of selecting and optimizing the configuration of information protection tools (IPT) for the security circuits of information and communication systems (ICS). The scientific novelty of the work lies in the fact that the GA proposes the use of the total amount of risks from information loss, as well as the integral indicator of IPT and cost indicators for each class of IPT, as criteria for optimizing the composition of IPT. The genetic algorithm in the problem of optimizing the choice of the composition of IPT for ICS is considered as a variation of the problem associated with multi-selection. In this regard, the optimization of the IPT placement along the ICS protection circuits is considered as a modification of the combinatorial knapsack problem. The GA used in the computing core of the decision support system (DSS) differs from the standard GA. As a part of the GA modification, the chromosomes are presented in the form of matrices, the elements of which are numbers that correspond to the IPT numbers in the ICS nodes. In the process of modifying the GA, a k-point crossing-over was applied. A fitness function is presented as the sum of efficiency factors. At the same time, in addition to the traditional absolute indicators of the IPT efficiency, the total value of risks from information loss, as well as cost indicators for each class of IPT are taken into account. The practical value of the research lies in the implementation of DSS based on the proposed modification of GA. Computational experiments on the selection of a rational software algorithm for implementing the model are performed. It is shown that the implementation of the GA in DSS allows to accelerate the search for optimal variants of cybersecurity (CS) tools placement for ICS by more than 25 times. This advantage allows not only to quickly search through the variety of hardware-software IPT and their combinations for ICS, but also to combine the proposed algorithm with the available models and algorithms for optimizing the composition of the ICS cybersecurity circuits. Potentially, such a combination of models and algorithms will make it possible to quickly rebuild the ICS protection, adjusting its profiles in accordance with new threats and classes of cyber attacks.

show abstract

“…Different organizations, such as companies and schools, build up networks to exchange information within the organizations. Network security has become one of the major concerns of most people and organizations when using computers and other Internet-enabled devices to access online resources and store valuable data [1].…”

Section: Introductionmentioning

confidence: 99%

An Efficient Feature Selection Approach for Intrusion Detection System using Decision Tree

Das¹,

Pramod²,

Sunitha³

2022

IJACSA

View full text Add to dashboard Cite

The intrusion detection system has been widely studied and deployed by researchers for providing better security to computer networks. The increasing volume of attacks, combined with the rapid improvement of machine learning (ML) has made the collaboration of intrusion detection techniques with machine learning and deep learnings are a popular subject and a feasible approach for cyber threat protection. Machine learning usually involves the training process using huge sample data. Since the huge input data may cause a negative effect on the training and detection performance of the machine learning model, feature selection becomes a crucial technique to rule out the irrelevant and redundant features from the dataset. This study applied a feature selection approach for intrusion detection that incorporated state-of-the-art feature selection algorithms with attack characteristic feature to produce an optimized set of features for the machine learning algorithms, which was then used to train the machine learning model. CSECIC-IDS2018 dataset, the most recent benchmark dataset with a wide attack diversity and features have been used to create the efficient feature subset. The result of the experiment was produced using machine learning models with a decision tree classifier and analyzed with respect to the accuracy, precision, recall, and f1 score.

show abstract

An approach for host based botnet detection system

Cited by 14 publications

References 3 publications

Analysis of Botnet Attack Communication Pattern Behavior on Computer Networks

Analysis of Botnet Attack Communication Pattern Behavior on Computer Networks

Decision Support System on Optimization of Information Protection Tools Placement

An Efficient Feature Selection Approach for Intrusion Detection System using Decision Tree

Contact Info

Product

Resources

About