Detection and prevention of botnets and malware in an enterprise network

Abstract

Abstract:One of the most significant threats faced by enterprise networks today is from Bots. A Bot is a program that operates as an agent for a user and runs automated tasks over the internet, at a much higher rate than would be possible for a human alone. A collection of Bots in a network, used for malicious purposes is referred to as a Botnet. Bot attacks can range from localized attacks like key-logging to network intensive attacks like Distributed Denial of Service (DDoS). In this paper, we suggest a novel approach that can detect and combat Bots. The proposed solution adopts a two pronged strategy which we have classified into the standalone algorithm and the network algorithm. The standalone algorithm runs independently on each node of the network. It monitors the active processes on the node and tries to identify Bot processes using parameters such as response time and output to input traffic ratio. If a suspicious process has been identified the network algorithm is triggered. The network algorithm will then analyze conversations to and from the hosts of the network using the transport layer flow records. It then tries to deduce the Bot pattern as well as Bot signatures which can subsequently be used by the standalone algorithm to thwart Bot processes at their very onset. Vineet Agarwal holds a B.Tech. in computer engineering from V.J.T.I and M.S. in Engineering Management from Santa Clara University. He has specialized in system analysis and design and his focus has been into implementing agile methodologies for software development.

A Survey of Machine Learning Methods and Challenges for Windows Malware Classification

“…DTW works directly upon numeric time series, and does not need the discretization provided by the Haar Transform (though the wavelets could be used to pre-process the signal before computing DTW). This method has received minimal investigation for malware classification (Naval et al, 2014), but has been used for related tasks such as estimating the prevalence or malware infection (Kang et al, 2016) and detecting botnets (Thakur et al, 2012). Its description is also representative of a simpler common ground between the prior work in this area (Han et al, 2015;Baysa et al, 2013;Sorokin, 2011;Shanmugam et al, 2013).…”

Study on Cloud Security Risk and Remedy

“…Temporary Storing on Local Disk: Another feasible way to minimize the attack is avoiding the constant connection to the internet. It can be possible by storing the file on local disk temporarily for one session and once all the operations of that session is done then update the cloud database [29]. However, This requires larger size of local disk which will be capable enough to store the session's information.…”

Multipath Routing of Fragmented Data Transfer in a Smart Grid Environment

“…x. The Message Authentication Code (MAC) (for full details refer [11]) for each packet of data is calculated and then compared to the MAC previously assigned to each packet and synced with (B). This is performed as a check for any tampering of data to alert the whole system.…”

“…Bots in a network can be detected and removed using Standalone algorithm and network algorithm. [11] 4. Secure communications in cognitive radio [4].…”