An Effective Conversation-Based Botnet Detection Method

Abstract

A botnet is one of the most grievous threats to network security since it can evolve into many attacks, such as Denial-of-Service (DoS), spam, and phishing. However, current detection methods are inefficient to identify unknown botnet. The high-speed network environment makes botnet detection more difficult. To solve these problems, we improve the progress of packet processing technologies such as New Application Programming Interface (NAPI) and zero copy and propose an efficient quasi-real-time intrusion detection system. Our work detects botnet using supervised machine learning approach under the high-speed network environment. Our contributions are summarized as follows: (1) Build a detection framework using PF_RING for sniffing and processing network traces to extract flow features dynamically. (2) Use random forest model to extract promising conversation features. (3) Analyze the performance of different classification algorithms. The proposed method is demonstrated by well-known CTU13 dataset and nonmalicious applications. The experimental results show our conversation-based detection approach can identify botnet with higher accuracy and lower false positive rate than flow-based approach.

On the resilience of P2P botnet footprints in the presence of legitimate P2P traffic

“…In contrast, the human generated traffic does not contain any similarity due to miscellaneous activities. To capture the statistical similarity of botnet traffic, many P2P botnet detection schemes 2,[25][26][27][28][29][30][31][32][33][34][35][36][37][38][39][40] proposed in which a group of statistical features is introduced as a P2P botnet footprint. These features are extracted from the botnet traffic and context network traffic.…”

“…[25][26][27][28][29][30][31][32][33][34] In some proposals, the notion of conversation is defined by a 2-tuple (source IP and destination IP), and some features are introduced to characterize the conversations produced by bots. 35,36 The host-based footprints are extracted from the network traffic of each host (like the number of IP addresses it connected to). 2,[37][38][39][40] The proposed footprints related to each class are detailed in following subsections.…”

Detection of Algorithmically Generated Malicious Domain

“…Firstly, the hardcoded IP address can be identified by a security researcher reverse engineering the malware, allowing mitigating action to be taken that may involve blacklisting the IP address [16]. Secondly, if the C&C server goes down or the IP address is detected, the nefarious activity can be easily identified and blocked by a security administrator which means their compromised device will be out of the attacker's control [13], [47].…”

“…Chen et al [13] suggest that the Peer-to-Peer (P2P) botnets infrastructure was one of the first architectural structures that criminals used for overcoming the limitations of the centralised C&C network approach. This is also known as a decentralised topology.…”

On Detecting and Removing Superficial Redundancy in Vector Databases

“…But these relations are not explicit and there are links among sources, types of attacks, reports, and incidents of the same type of attacks. Finally, the value is precisely the actionable knowledge that we can get from the cyber database from analyzing the quality of the data, automatized process, prediction of incidents, or detecting intrusion in different networks (see [30][31][32]). …”