Detecting Botnets Through Log Correlation

Yousof Al-Hammadi,Uwe Aickelin

doi:10.2139/ssrn.2831379

Abstract

Botnets, which consist of thousands of compromised machines, can cause significant threats to other systems by launching Distributed Denial of Service (DDoS) attacks, keylogging, and backdoors. In response to these threats, new effective techniques are needed to detect the presence of botnets. In this paper, we have used an interception technique to monitor Windows Application Programming Interface (API) functions calls made by communication applications and store these calls with their arguments in log files. Our algorithm detects botnets based on monitoring abnormal activity by correlating the changes in log file sizes from different hosts.

Highlights

An explosive growth of coordinated attacks has been noticed [1][6]
We focus on detecting botnets that use a centralized network
We investigate the normal behaviour of an mIRC clients vs. the sdbot

Summary

INTRODUCTION

An explosive growth of coordinated attacks has been noticed [1][6]. This kind of attack is performed by using Internet Relay Chat (IRC) networks to control compromised machines (zombies) and establish a distributed attack against other systems. A collection of compromised machines that are connected to a single channel on IRC networks forms a (Botnet) These machines can be controlled remotely by the attacker via command and control (C&C) to perform malicious activities such as DDoS attack. Most current bots are implemented to use a centralized network, which allow them to receive instructions from a central point This makes the process of tracing the bot herder (i.e. the attacker) a relatively easy task. The outgoing connections have different lengths and the number of bytes transferred per connection is not fixed [2] To address these problems, our aim is to detect botnets by monitoring the change of behaviour in log file sizes across several hosts and find the correlation between these changes.

DATA COLLECTION

Full details of Architecture

Experiments

RESULTS

Botnet Detection through Distributed Log Correlation

CONCLUSION AND FUTURE WORK