Packet sampling for worm and botnet detection in TCP connections

Abstract

Malware and botnets pose a steady and growing threat to network security. Therefore, packet analysis systems examine network traffic to detect active botnets and spreading worms. However, with the advent of multi-gigabit link speeds, capturing and analysing header and payload of every packet requires enormous amounts of computational resources and is therefore not feasible in many situations. We address this problem by presenting an efficient packet sampling algorithm that picks a small number of packets from the beginning of every TCP connection. Bloom filters are used to store the required connection state information with constant amount of memory. Our analysis of worm and botnet traffic shows that the large majority of attack signatures is actually found in these packets. Thus, our sampling algorithm can be deployed in front of a detection system to reduce the amount of inspected packets without degrading the detection results significantly.

Security Data Collection and Data Analytics in the Internet: A Survey

“…After analyzing real worms and botnet traffic with Snort, Braun et al [153] concluded that the majority of the signatures of such attacks can be found by checking the first few kilobytes of payload during TCP connections. They employed two timeout Bloom filters that are composed of timestamps instead of bits to respectively store the start and end time of a connection.…”

MBotCS: A Mobile Botnet Detection System Based on Machine Learning

“…Hence, UDP traffic was excluded from further analysis and the training phase focused on TCP traffic only. This was plausible as botnets involve a series of communications between the bot master and the mobile botnets that is based on TCP traffic [6]. Following the packets and stream labeling, the features used for training were: Packets/Stream Frame Duration, Packets/Stream Packet Size, and Arguments Number in HTTP Request URL.…”

Fast Parallel Network Packet Filter System based on CUDA

“…In general, an attacker conducts the bots to launch a variety of types of attacks such as phishing and spamming with a botn et, and then receives benefits from a variety of aspects such as economy and social security. Most of methods to detect bot's activities according to predefined patterns and signatures retrieved from well-known bots 3,4,5,6,7,8 . Although signature-based approaches are able to detect bots accurately, it is difficult to detect botnet in real time.…”