B-Corr Model for Bot Group Activity Detection Based on Network Flows Traffic Analysis

Abstract

Botnet is a type of dangerous malware. Botnet attack with a collection of bots attacking a similar target and activity pattern is called bot group activities. The detection of bot group activities using intrusion detection models can only detect single bot activities but cannot detect bots' behavioral relation on bot group attack. Detection of bot group activities could help network administrators isolate an activity or access a bot group attacks and determine the relations between bots that can measure the correlation. This paper proposed a new model to measure the similarity between bot activities using the intersections-probability concept to define bot group activities called as B-Corr Model. The B-Corr model consisted of several stages, such as extraction feature from bot activity flows, measurement of intersections between bots, and similarity value production. B-Corr model categorizes similar bots with a similar target to specify bot group activities. To achieve a more comprehensive view, the B-Corr model visualizes the similarity values between bots in the form of a similar bot graph. Furthermore, extensive experiments have been conducted using real botnet datasets with high detection accuracy in various scenarios.

Botnet Attack Analysis through Graph Visualization

“…Graph visualization-based analysis techniques are often implemented in botnet attack analysis techniques [15,22], attack event analysis [23], or event forensics [24]. In [15,22], simple visualization can be done by identifying the direction of the attacker's communication in graph-directed interaction (GDI), representing the attack as a node and communication as an edge. Rabzelj et al [23] conducted an attack analysis with data distribution originating from an intrusion detection system known as a honeypot.…”

The Optimization of the ARP Poisoning Attack Detection Model Using a Similar Approach Based on NetFlow Analysis

“…The intended relationship was the similarity between the two attacker activities. If two different attackers are represented as nodes A and B, there may be a difference in similarity between A to B and B to A [24]. To determine whether two attacking objects are similar and have a substantial similarity value, it is necessary to analyze the similarity threshold value [25].…”