Botnets: A survey

Abstract-This paper addresses the issue of detecting unwanted traffic in data networks, namely the detection of botnet networks. In this paper, we focused on a time behavioral analysis, more specifically said -lifespans of a simulated botnet network traffic, collected and discovered from NetFlow messages, and also of real botnet communication of a malware.As a method we chose survival analysis and for rigorous testing of differences Mantel-Cox test. Lifespans of those referred traffics are discovered and calculated by lifelines using Python language.Based on our research we have figured out a possibility to distinguish the individual lifespans of C&C communications that are identical to each other by using survival projection curves, although it occurred in a different time course.

show abstract

“…Sérgio S.C. Silva et al presented in [3] a comprehensive view on the issue of botnet networks. We take over principles of botnet behavior.…”

Section: Related Workmentioning

confidence: 99%

“…It is very difficult and complex issue. More types of botnet networks and their behavior are distinguished [3]. The basic is with Internet Relay Chat (IRC) communication approach.…”

Section: Introduction To the Problemmentioning

confidence: 99%

Botnet C&C Traffic and Flow Lifespans Using Survival Analysis

Oujezský

Horváth

Skorpil

2017

IJATES

View full text Add to dashboard Cite

show abstract

“…Despite having a significant increase in research on botnets in recent years, very few results have been adopted and implemented in real network scenarios [8]. Among the current botnet detection systems implemented for real network environment we have many well-known signature-based techniques [9]- [11].…”

Section: Related Workmentioning

confidence: 99%

CluSiBotHealer: Botnet Detection through Similarity Analysis of Clusters

Barthakur¹,

Dahal²,

Ghose³

2015

JACN

View full text Add to dashboard Cite

Abstract-Botnets are responsible for most of the security threats in the Internet. Botnet attacks often leverage on their coordinated structures among bots spread over a vast geographical area. In this paper, we propose CluSiBotHealer, a novel framework for detection of Peer-to-Peer (P2P) botnets through data mining technique. P2P botnets are more resilient structure of botnets (re)designed to overcome single point of failure of centralized botnets. Our proposed system is based on clustering of C&C flows within a monitored network for suspected bots. Leveraging on similarity of packet structures and flow structures of frequently exchanged C&C flows within a P2P botnet, our proposed system initially uses clustering of flows and then Jaccard similarity coefficient on sample sets derived from clusters for accurate detection of bots. Ours is a very effective and novel framework which can be used for proactive detection of P2P bots within a monitored network. We empirically validated our model on traces collected from three different P2P botnets namely Nugache, Waledac and P2P Zeus.

show abstract

“…For businesses, infected machines are vulnerable to the same kind of attacks, but often with more severe consequences such as stealing business secrets or destruction of data that is crucial to the operation of the company. Another particular kind of malware, botnets, makes a strong tool for cyber criminals [6,9]. Computers infected with bot malware (also known as zombies) can be remotely controlled and used for a number of malicious activities, often targeting business or infrastructure that is critical for society.…”

Section: Introductionmentioning

confidence: 99%