Abstract
Botnets are networks composed with malware-infect ed computers. They are designed and organized to be controlled by an adversary. As victims are infected through their inappropriate network behaviors in most cases, the Internet protocol (IP) addresses of infected bots are unpredictable. Plus, a bot can get an IP address through dynamic host configuration protocol (DHCP), so they need to get in touch with the controller initiatively and they should attempt continuously because a controller can't be always online. The whole process is carried out under the command and control (C&C) channel. Our goal is to characterize the network traffic under the C&C channel on the time domain. Our analysis draws upon massive data obtained from honeynet and a large Internet service provider (ISP) Network. We extract and summarize fingerprints of the bots collected in our honeynet. Next, with the fingerprints, we use deep packet inspection (DPI) Technology to search active bots and controllers in the Internet. Then, we gather and analyze flow records reported from network traffic monitoring equipments. In this paper, we propose a flow record interval analysis on the time domain characteristics of botnets control traffic, and we propose the algorithm to identify the communications in the C&C channel based on our analysis. After that, we evaluate our approach with a 3.4 GB flow record trace and the result is satisfactory. In addition, we believe that our work is also useful information in the design of botnet detection schemes with the deep flow inspection (DFI) technology.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
More From: The Journal of China Universities of Posts and Telecommunications
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.