P2P Botnet Detection Based on Nodes Correlation by the Mahalanobis Distance

Abstract

Botnets are a common and serious threat to the Internet. The search for the infected nodes of a P2P botnet is affected by the number of commonly connected nodes, with a lower detection accuracy rate for cases with fewer commonly connected nodes. However, this paper calculates the Mahalanobis distance—which can express correlations between data—between indirectly connected nodes through traffic with commonly connected nodes, and establishes a relationship evaluation model among nodes. An iterative algorithm is used to obtain the correlation coefficient between the nodes, and the threshold is set to detect P2P botnets. The experimental results show that this method can effectively detect P2P botnets with an accuracy of >85% when the correlation coefficient is high, even in cases with fewer commonly connected nodes.

PAutoBotCatcher: A blockchain-based privacy-preserving botnet detector for Internet of Things

“…For statistical approaches, the authors in [44] have used Mahalanobis distance to calculate the correlation between nodes in order to detect botnets. Mahalanobis distance can express correlations among indirectly connected nodes based on their traffic with commonly connected nodes.…”

“…Mahalanobis distance can express correlations among indirectly connected nodes based on their traffic with commonly connected nodes. In [44], an iterative algorithm was proposed to get the correlation coefficient between the nodes with a pre-defined threshold of 85% to detect P2P botnets. Authors in [19] have proposed a hybrid distributed solution that combines a quantitative model and distributed threat intelligence.…”

LiMNet: Early-Stage Detection of IoT Botnets with Lightweight Memory Networks

“…As P2P bots frequently communicate with each other, community detection techniques have proven effective in detecting them [5,27,23]. Statistical approaches have also been used to identify correlations between nodes and thus infer botnet affiliations [26,15].…”