Diagnosing bot infections using Bayesian inference

Ashfaq, Ayesha Binte; Abaid, Zainab; Ismail, Maliha; Aslam, Muhammad Umar; Syed, Affan A.; Khayam, Syed Ali

doi:10.1007/s11416-016-0286-y

Cited by 3 publications

(1 citation statement)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Surprisingly, not much difference is immediately obvious between HTTP and HTTP(S) results despite the very different characteristics of their underlying data. The Wilcoxon signed-rank test was used [41][42][43] to test the significance of differences between all pairs of HTTP and HTTP(S) measurements: plain, local, global and pairwise. Figure 8A,B shows that Plot (A) differs from plot (B) only in the scale of the y-axis to highlight different parts of the plots.…”

mentioning

confidence: 99%

Efficacy Improvement of Anomaly Detection by Using Intelligence Sharing Scheme

Tahir

Ayoub

et al. 2019

Applied Sciences

View full text Add to dashboard Cite

Computer networks are facing threats of ever-increasing frequency and sophistication. Encryption is becoming the norm in both legitimate and malicious network traffic. Therefore, intrusion detection systems (IDSs) are now required to work efficiently regardless of the encryption. In this study, we propose two new methods to improve the efficacy of the Cisco Cognitive Threat Analytics (CTA) system. In the first method, the efficacy of CTA is improved by sharing of intelligence information across a large number of enterprise networks. In the second method, a four variant-based global reputation model (GRM) is designed by employing an outlier ensemble normalization algorithm in the presence of missing data. Intelligence sharing provides additional information in the intrusion detection process, which is much needed, particularly for analysis of encrypted traffic with inherently low information content. Robustness of the novel outlier ensemble normalization algorithm is also demonstrated. These improvements are measured using both encrypted and non-encrypted network traffic. Results show that the proposed information sharing methods greatly improve the anomaly detection efficacy of malicious network behavior with bad base-line detection efficacy and slightly improve upon the average case.

show abstract

mentioning

confidence: 99%

Efficacy Improvement of Anomaly Detection by Using Intelligence Sharing Scheme

Tahir

Ayoub

et al. 2019

Applied Sciences

View full text Add to dashboard Cite

show abstract

Botnet Communication Patterns

Vormayr

Zseby

Fabini

2017

IEEE Commun. Surv. Tutorials

122

View full text Add to dashboard Cite

BOTection: Bot Detection by Building Markov Chain Models of Bots Network Behavior

AlAhmadi

Mariconti

Spolaor

et al. 2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

Botnets continue to be a threat to organizations, thus various machine learning-based botnet detectors have been proposed. However, the capability of such systems in detecting new or unseen botnets is crucial to ensure its robustness against the rapid evolution of botnets. Moreover, it prolongs the effectiveness of the system in detecting bots, avoiding frequent and time-consuming classifier retraining. We present BOTection, a privacy-preserving bot detection system that models the bot network flow behavior as a Markov Chain. The Markov Chains state transitions capture the bots' network behavior using high-level flow features as states, producing content-agnostic and encryption resilient behavioral features. These features are used to train a classifier to first detect flows produced by bots, and then identify their bot families. We evaluate our system on a dataset of over 7M malicious flows from 12 botnet families, showing its capability of detecting bots' network traffic with 99.78% F-measure and classifying it to a malware family with a 99.09% F-measure. Notably, due to the modeling of general bot network behavior by the Markov Chains, BOTection can detect traffic belonging to unseen bot families with an F-measure of 93.03% making it robust against malware evolution.

show abstract

Diagnosing bot infections using Bayesian inference

Cited by 3 publications

References 20 publications

Efficacy Improvement of Anomaly Detection by Using Intelligence Sharing Scheme

Efficacy Improvement of Anomaly Detection by Using Intelligence Sharing Scheme

Botnet Communication Patterns

BOTection: Bot Detection by Building Markov Chain Models of Bots Network Behavior

Contact Info

Product

Resources

About