Detecting P2P botnets through network behavior analysis and machine learning

Saad, Sherif; Traoré, Issa; Ghorbani, Ali A.; Sayed, Bassam; Zhao, David; Lu, Wei; Felix, John; Hakimian, Payman

doi:10.1109/pst.2011.5971980

Cited by 217 publications

(153 citation statements)

References 12 publications

Supporting

Mentioning

145

Contrasting

Unclassified

Order By: Relevance

“…The number of datasets containing modern malware traces is limited. Worth mentioning are ISOT [113] and CTU-13 [114]. The first one is a mixture of malicious and non-malicious datasets.…”

Section: Origin Of the Ideamentioning

confidence: 99%

An Entropy-Based Network Anomaly Detection Method

Bereziński

Jasiul

Szpyrka

2015

Entropy

161

View full text Add to dashboard Cite

Data mining is an interdisciplinary subfield of computer science involving methods at the intersection of artificial intelligence, machine learning and statistics. One of the data mining tasks is anomaly detection which is the analysis of large quantities of data to identify items, events or observations which do not conform to an expected pattern. Anomaly detection is applicable in a variety of domains, e.g., fraud detection, fault detection, system health monitoring but this article focuses on application of anomaly detection in the field of network intrusion detection.The main goal of the article is to prove that an entropy-based approach is suitable to detect modern botnet-like malware based on anomalous patterns in network. This aim is achieved by realization of the following points: (i) preparation of a concept of original entropy-based network anomaly detection method, (ii) implementation of the method, (iii) preparation of original dataset, (iv) evaluation of the method.

show abstract

“…The number of datasets containing modern malware traces is limited. Worth mentioning are ISOT [113] and CTU-13 [114]. The first one is a mixture of malicious and non-malicious datasets.…”

Section: Origin Of the Ideamentioning

confidence: 99%

An Entropy-Based Network Anomaly Detection Method

Bereziński

Jasiul

Szpyrka

2015

Entropy

161

View full text Add to dashboard Cite

show abstract

“…In these studies, P2P botnets are detected by analyzing the behavioral characteristics of the network traffic (Saad et al, 2011;Kheir and Wolley, 2013;Dillon, 2014;He et al, 2014;Almutairi et al, 2016).…”

Section: Review Of Related Literaturementioning

confidence: 99%

A Novel Botnet Detection System for P2P Networks

Obeidat¹,

Al-Kofahi²,

Bawaneh³

et al. 2017

Journal of Computer Science

View full text Add to dashboard Cite

Botnets remain an active security problem on the Internet and various computer networks. They are continuously developing with regard to protocols, structure and quality of attacks. Many botnet detection programs are currently available, but only few can detect bots in real-time. The sooner bots are detected the lesser damage they can cause. In this paper, a novel botnet detection system, is proposed to detect peer-to-peer bots. The system consists of three-phases filtering, P2P detection and P2P botnet detection phases. For the third phase, P2P network behavior analysis is performed to detect P2P bots. Experimental results showed that the system exhibits high average true positive rate and extremely low average false positive rate during botnet detection.

show abstract

“…Machine learning is used because it offers the possibility of automated, real-time recognition of patterns within traffic without a need for traffic exhibiting specific anomalies. Several detection approaches that employ machine learning have been proposed over the years such as in Strayer et al [27], Botminer [8], Lu et al [13], Saad et al [22], and Zhang et al [36], providing more or less efficient botnet detection.…”

Section: Network-based Detectionmentioning

confidence: 99%

“…A recent study in the field of botnet detection by Saad et al [22] considers the problem of detecting P2P botnets by using machine learning techniques. The study evaluates the ability of commonly used machine-learning techniques to meet on-line botnet detection requirements such as adaptability, novelty detection and early detection.…”

Section: Network-based Detectionmentioning

confidence: 99%

A Collaborative Approach to Botnet Protection

Stevanovic

Revsbech

Pedersen

et al. 2012

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Botnets are collections of compromised computers which have come under the control of a malicious person or organisation via malicious software stored on the computers, and which can then be used to interfere with, misuse, or deny access to a wide range of Internet-based services. With the current trend towards increasing use of the Internet to support activities related to banking, commerce, healthcare and public administration, it is vital to be able to detect and neutralise botnets, so that these activities can continue unhindered. In this paper we present an overview of existing botnet detection techniques and argue why a new, composite detection approach is needed to provide efficient and effective neutralisation of botnets. This approach should combine existing detection efforts into a collaborative botnet protection framework that receives input from a range of different sources, such as packet sniffers, on-access anti-virus software and behavioural analysis of network traffic, computer sub-systems and application programs. Finally, we introduce ContraBot, a collaborative botnet detection framework which combines approaches that analyse network traffic to identify patterns of botnet activity with approaches that analyse software to detect items which are capable of behaving maliciously.

show abstract

Detecting P2P botnets through network behavior analysis and machine learning

Cited by 217 publications

References 12 publications

An Entropy-Based Network Anomaly Detection Method

An Entropy-Based Network Anomaly Detection Method

A Novel Botnet Detection System for P2P Networks

A Collaborative Approach to Botnet Protection

Contact Info

Product

Resources

About