Detection of randomized bot command and control traffic on an end-point host

Soniya, B.; Wilscy, M.

doi:10.1016/j.aej.2016.04.004

Cited by 13 publications

(16 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…the compromised machine) could be either computers, mobile phones etc. [5,[38][39][40]. Botnets attacks escalate geometrically as criminals have found them a safe-haven to perpetuate attacks for several reasons.…”

Section: Smart Meter Data and Electricity Theftmentioning

confidence: 99%

“…Hence, an intrusion detection systems (IDSs) are required as another level of protection [41]. An efficient IDSs must first uncover the behaviours of the bots to aid the design, detection and blocking mechanism [38,39]. This is done by exploring the communication patterns of the bots C&C channel which is its weakest link, since it is the only link the bot-master communicates with its bots, and block them before any serious harm is done [5,39,42,43].…”

Section: Smart Meter Data and Electricity Theftmentioning

confidence: 99%

“…In this approach, scanning is carried out only at convenience but usually when suspicious activities are suspected. The online-based scanning is real time and able to run the scan at a pre-set interval of time [39,44,45]. IDS can also be classified based on other techniques depending on the nature of the attacks and with respect to its detection principle.…”

Section: Smart Meter Data and Electricity Theftmentioning

confidence: 99%

“…A centralized energy detection scheme was proposed utilizing the Kalman filter by Salinas and Li [2]. They proposed a privacy-preserving energy detection-based algorithm to identify fraudulent customers while Soniya and Wilscy [39] proposed an intrusion detection technique capable of early and randomised detection utilising traffic analysis of an end-point host in identifying bot's C&C communication. These algorithms depend on the systems' parameters' fore-knowledge.…”

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Electricity theft detection framework based on universal prediction algorithm

Otuoze

Mustafa

Sofimieari

et al. 2019

IJEECS

View full text Add to dashboard Cite

<span lang="EN-GB">Electricity theft has caused huge losses over the globe and the trend of its perpetuation constantly evolve even as smart technologies such as smart meters are being deployed. Although the smart meters have come under some attacks, they provide sufficient data which can be analysed by an intelligent strategy for effective monitoring and detection of compromised situations. So many techniques have been employed but satisfactory result is yet to be obtained for a real-time detection of this electrical fraud. This work suggests a framework based on Universal Anomaly Detection (UAD) utilizing Lempel-Ziv universal compression algorithm, aimed at achieving a real-time detection in a smart grid environment. A number of the network parameters can be monitored to detect anomalies, but this framework monitors the energy <a name="_Hlk725881"></a>consumption data, rate of change of the energy consumption data, its date stamp and time signatures. To classify the data based on normal and abnormal behaviour, Lempel-Ziv algorithm is used to assign probability of occurrence to the compressed data of the monitored parameters. This framework can learn normal behaviours of smart meter data and give alerts during any detected anomaly based on deviation from this probability. A forced aggressivemeasure is also suggested in the framework as means of applying fines to fraudulent customers.</span>

show abstract

Section: Smart Meter Data and Electricity Theftmentioning

confidence: 99%

Section: Smart Meter Data and Electricity Theftmentioning

confidence: 99%

Section: Smart Meter Data and Electricity Theftmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Electricity theft detection framework based on universal prediction algorithm

Otuoze

Mustafa

Sofimieari

et al. 2019

IJEECS

View full text Add to dashboard Cite

show abstract

“…Although the detection of the configuration of a communication channel between a host infected by malicious code and a C&C server has been the focus of several studies, including [3,7,26], these detection methods may encounter an increase in false positives or false negatives when the C&C channel occurs irregularly. The methodology here proposes the APChain algorithm to alleviate the existing problems by using connection time intervals, frequencies, and standard deviations to perform behavioral profiling and thus detect abnormal behavior.…”

Section: Candc Channel Detection [Case Study A]mentioning

confidence: 99%

Abnormal Behavior Detection to Identify Infected Systems Using the APChain Algorithm and Behavioral Profiling

Seo

Lee

2018

Security and Communication Networks

View full text Add to dashboard Cite

Recent cyber-attacks have used unknown malicious code or advanced attack techniques, such as zero-day attacks, making them extremely difficult to detect using traditional intrusion detection systems. Botnet attacks, for example, are a very sophisticated type of cyber-security threat. Malicious code or vulnerabilities are used to infect endpoints. Systems infected with this malicious code connect a communications channel to a command and control (C&C) server and receive commands to perform attacks on target servers. To effectively protect a corporate network’s resources against such threats, we must be able to detect infected systems before an attack occurs. In this paper, an attack pattern chain algorithm (APChain) is proposed to identify infected systems in real-time network environments, and a methodology for detecting abnormal behavior through network-based behavioral profiling is explained. APChain analyzes the attribute information of real-time network traffic, connects chains over time, and conducts behavioral profiling of different attack types to detect abnormal behavior. The dataset used in the experiment employed real-time traffic accumulated over a period of six months, and the proposed algorithm was developed into a prototype for the experiment. The C&C channel detection accuracy was measured at 0.996, the true positive rate at 1.0, and the false positive rate at 0.003. This study proposes a methodology that can overcome the limitations of conventional security mechanisms and suggests an approach to the detection of abnormal behavior in a real-time network environment.

show abstract