FPMBot: Discovering the frequent pattern of IoT-botnet domain queries in large-scale network

Qian, Kexiang; Li, Yixin; Zhu, Muyijie; Liu, Yin; Wang, Bin; Luo, Xi

doi:10.1016/j.comcom.2022.05.012

Cited by 6 publications

(3 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Step 1. According to the botnet detection method based on recursive variant autoencoder, 17 the time window is set as [5,10,15,20,30,60,90,120,240,480,960,1200,1800] in seconds (s).…”

Section: Feature Reconstructionmentioning

confidence: 99%

“…Unlike traditional network security threats, 6–8 botnets have higher concealment, faster propagation speed, more infection channels, and more substantial destructive power. To strengthen the network security defense system of IoT, prevent the information leakage of devices 9 and protect users' privacy, there is a need to research and propose accurate and efficient botnet detection methods, which have become a research hotspot in IoT security 10,11 …”

Section: Introductionmentioning

confidence: 99%

“…To strengthen the network security defense system of IoT, prevent the information leakage of devices 9 and protect users' privacy, there is a need to research and propose accurate and efficient botnet detection methods, which have become a research hotspot in IoT security. 10,11 The existing network traffic samples used in IoT botnet detection studies have a large gap between the number of normal traffic and botnet traffic. The computational time and space overhead when using the traditional resampling algorithms to balance the various types of samples in network traffic are large, which is unsuitable for the IoT environment with limited computing resources.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

IoT botnet detection with feature reconstruction and interval optimization

Yang

Wang

Zhang

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

The existing botnet detection methods have the problems of uneven sampling, poor feature selection, and weak generalization ability, resulting in low detection and classification results and poor adaptability to the internet of things (IoT) environment with limited computing and storage resources. This paper proposes an IoT botnet detection method using feature reconstruction and interval optimization to solve the above problems. Through the designed address triple and time window‐based IP aggregation and feature reconstruction method (ATTW‐IP‐FR), the network traffic samples obtained from the IoT gateway are integrated, and the flow features are reconstructed to attain the reconstructed sample set. The proposed self‐corrected hybrid weighted sampling algorithm balances the normal and botnet flow samples in the reconstructed sample set to get the resampling sample set. The introduced multiattribute decision‐making and adjacency relation chain‐based sequential forward selection algorithm is applied to eliminate the redundant features in the resampling sample set, and the optimal feature subset is obtained. The resampling sample set filtered by the optimal feature subset is detected and classified through the designed two‐stage hybrid heterogeneous model optimized by the intermittent chaos and bald eagle search algorithm‐based interval optimization algorithm. The experimental results show that the proposed method effectively detects the botnet in two real IoT scenarios. The detection accuracy is 99.17% $ \% $, the Matthews correlation coefficient is 98.35% $ \% $, the false positive rate is 0.25% $ \% $, and the false negative rate is 1.27% $ \% $, which are better than the existing methods. This method can effectively reduce sampling and feature selection time and space overhead and better adapt to the resource‐constrained IoT environment.

show abstract

“…Step 1. According to the botnet detection method based on recursive variant autoencoder, 17 the time window is set as [5,10,15,20,30,60,90,120,240,480,960,1200,1800] in seconds (s).…”

Section: Feature Reconstructionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

IoT botnet detection with feature reconstruction and interval optimization

Yang

Wang

Zhang

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

show abstract

Botnets Unveiled: A Comprehensive Survey on Evolving Threats and Defense Strategies

Asadi,

Jamali,

Heidari

et al. 2024

Trans Emerging Tel Tech

View full text Add to dashboard Cite

Botnets have emerged as a significant internet security threat, comprising networks of compromised computers under the control of command and control (C&C) servers. These malevolent entities enable a range of malicious activities, from denial of service (DoS) attacks to spam distribution and phishing. Each bot operates as a malicious binary code on vulnerable hosts, granting remote control to attackers who can harness the combined processing power of these compromised hosts for synchronized, highly destructive attacks while maintaining anonymity. This survey explores botnets and their evolution, covering aspects such as their life cycles, C&C models, botnet communication protocols, detection methods, the unique environments botnets operate in, and strategies to evade detection tools. It analyzes research challenges and future directions related to botnets, with a particular focus on evasion and detection techniques, including methods like encryption and the use of covert channels for detection and the reinforcement of botnets. By reviewing existing research, the survey provides a comprehensive overview of botnets, from their origins to their evolving tactics, and evaluates how botnets evade detection and how to counteract their activities. Its primary goal is to inform the research community about the changing landscape of botnets and the challenges in combating these threats, offering guidance on addressing security concerns effectively through the highlighting of evasion and detection methods. The survey concludes by presenting future research directions, including using encryption and covert channels for detection and strategies to strengthen botnets. This aims to guide researchers in developing more robust security measures to combat botnets effectively.

show abstract