Botnet Detection System Research Articles

On the resilience of P2P botnet footprints in the presence of legitimate P2P traffic

SummaryBotnet is a distributed platform for illegal activities severely threaten the security of the Internet. Fortunately, although their complicated nature, bots leave some footprints during the C&C communication that have been utilized by security researchers to design detection mechanisms. Nevertheless, botnet designers are always trying to evade detection systems by leveraging the legitimate P2P protocol as C&C channel or even mimicking legitimate peer‐to‐peer (P2P) behavior. Consequently, detecting P2P botnet in the presence of normal P2P traffic is one of the most challenging issues in network security. However, the resilience of P2P botnet detection systems in the presence of normal P2P traffic is not investigated in most proposed schemes. In this paper, we focused on the footprint as the most essential part of a detection system and presented a taxonomy of footprints utilized in behavioral P2P botnet detection systems. Then, the resilience of mentioned footprints is analyzed using three evaluation scenarios. Our experimental and analytical investigations indicated that the most P2P botnet footprints are not resilient to the presence of legitimate P2P traffic and there is a pressing need to introduce more resilient footprints.

BotCluster: A session-based P2P botnet clustering system on NetFlow

This study presents a session-based P2P botnet clustering system implemented on MapReduce for aggregating malicious hosts within NetFlow traffic logs. The proposed botnet detection system, designated as BotCluster, merges the unidirectional records of NetFlow into bidirectional sessions and then utilizes a 3-level grouping to cluster similar sessions into groups with a like behavior. Besides, BotCluster would eliminate unrelated sessions and keep the large irregular sessions using the similarity and regularity of Botnets in their communication nature. The clustered groups can be considered as malicious behavioral collections because only man-made malware would generate the large of the similar pattern in network traces. The performance of BotCluster is evaluated using real-world NetFlow traffic logs collected from two university campuses in Taiwan (i.e., NCKU and CCU). The datasets have sizes of 239GB and 137GB, respectively, and contain a total of approximately 2.4 billion flows and a total of approximately 18 million IP address. The precision of the BotCluster detection results is evaluated using the VirusTotal blacklist service. It is shown that BotCluster achieves a detection precision of 96.23% and 86.62% for the NCKU and CCU datasets, respectively. Finally, when applied to a combined dataset containing the NetFlow logs of both campuses, BotCluster achieves an average precision of 97.58%. In other words, given sufficient observation duration, BotCluster provides the ability to detect even stealthy and concealed bots with a high degree of reliability.

Adaptive traffic sampling for P2P botnet detection

SummaryPeer‐to‐peer (P2P) botnets have become one of the major threats to network security. Most existing botnet detection systems detect bots by examining network traffic. Unfortunately, the traffic volumes typical of current high‐speed Internet Service Provider and enterprise networks are challenging for these network‐based systems, which perform computationally complex analyses. In this paper, we propose an adaptive traffic sampling system that aims to effectively reduce the volume of traffic that P2P botnet detectors need to process while not degrading their detection accuracy. Our system first identifies a small number of potential P2P bots in high‐speed networks as soon as possible, and then samples as many botnet‐related packets as possible with a predefined target sampling rate. The sampled traffic then can be delivered to fine‐grained detectors for further in‐depth analysis. We evaluate our system using traffic datasets of real‐world and popular P2P botnets. The experiments demonstrate that our system can identify potential P2P bots quickly and accurately with few false positives and greatly increase the proportion of botnet‐related packets in the sampled packets while maintain the high detection accuracy of the fine‐grained detectors.

A Novel Botnet Detection System for P2P Networks

Botnets remain an active security problem on the Internet and various computer networks. They are continuously developing with regard to protocols, structure and quality of attacks. Many botnet detection programs are currently available, but only few can detect bots in real-time. The sooner bots are detected the lesser damage they can cause. In this paper, a novel botnet detection system, is proposed to detect peer-to-peer bots. The system consists of three-phases filtering, P2P detection and P2P botnet detection phases. For the third phase, P2P network behavior analysis is performed to detect P2P bots. Experimental results showed that the system exhibits high average true positive rate and extremely low average false positive rate during botnet detection.

On the Use of Machine Learning for Identifying Botnet Network Traffic

During the last decade significant scientific efforts have been invested in the development of methods that could provide efficient and effective botnet detection.As a result, an array of detection methods based on diverse technical principles and targeting various aspects of botnet phenomena have been defined. As botnets rely on the Internet for both communicating with the attacker as well as for implementing different attack campaigns, network traffic analysis is one of the main means of identifying their existence. In addition to relying on traffic analysis for botnet detection, many contemporary approaches use machine learning techniques for identifying malicious traffic. This paper presents a survey of contemporary botnet detection methods that rely on machine learning for identifying botnet network traffic. The paper provides a comprehensive overview on the existing scientific work thus contributing to the better understanding of capabilities, limitations and opportunities of using machine learning for identifying botnet traffic. Furthermore, the paper outlines possibilities for the future development of machine learning-based botnet detection systems.

BotGrab: A negative reputation system for botnet detection

Botnets continue to be used by attackers to perform various malicious activities on the Internet. Over the past years, many botnet detection techniques have been proposed; however, most of them cannot detect botnets in an early stage of their lifecycle, or they often depend on a specific command and control protocol. In this paper, we propose BotGrab, a general botnet detection system that considers both malicious activities and the history of coordinated group activities in the network to identify bot-infected hosts. BotGrab tracks suspected hosts participating in some coordinated group activities and calculates a negative reputation score for each of them based on the history of their participation in these activities. A suspected host will be identified as being bot-infected if it has a high negative reputation score or performs some malicious activities while having a low negative reputation score. We demonstrate the effectiveness of BotGrab to detect various botnets including HTTP-, IRC-, and P2P-based botnets using a testbed network consisting of some bot-infected hosts.

RTECA: Real time episode correlation algorithm for multi-step attack scenarios detection

Today, from information security perspective, prevention methods are not enough solely. Early Warning Systems (EWSs) are in the category of reactive methods. These systems are complementing Intrusion Detection Systems (IDSs) where their main goals include early detection of potential malicious behavior in large scale environments such as national level. An important process in EWSs is the analysis and correlation of alerts aggregated from the installed sensors (e.g., IDSs, IP telescopes, and botnet detection systems). In this paper, an efficient framework for alert correlation in EWSs is proposed. The framework includes a correlation scheme based on a combination of statistical and stream mining techniques. The method works real-time by extracting critical episodes from sequences of alerts, which could be part of multi-step attack scenarios. A Causal Correlation Matrix (CCM) is used for encoding correlation strength between the alert types in attack scenarios. Experimental results show that the framework is efficient enough in detecting known attack scenarios and new attack strategies. The results also show that the system is able to predict the next steps of running attack scenaris up to 95% of accuracy under special circumstances.

P2P-BDS: Peer-2-Peer Botnet Detection System

Internet has become an inevitable part of our lives. While internet offers a mass of useful services which makes communication easier and faster than ever, it presents some threats too along the way. Over the last few years, botnet has risen to become the primary source for various internet attacks such as DDos attacks, spamming, phishing etc. Accordingly, a great deal of research has focused on methods to detect and extenuate the effects of botnets. In this paper, we have analyzed the feasibility of outgoing and incoming traffic i.e. intrusions and extrusions, to detect P2P based botnets. We present an approach that uses a network perimeter mentoring system called bothunter. As a part of the research work, a botnet detection system for peer to peer botnets called P2P-BDS has been proposed.

Building a Scalable System for Stealthy P2P-Botnet Detection

Peer-to-peer (P2P) botnets have recently been adopted by botmasters for their resiliency against take-down efforts. Besides being harder to take down, modern botnets tend to be stealthier in the way they perform malicious activities, making current detection approaches ineffective. In addition, the rapidly growing volume of network traffic calls for high scalability of detection systems. In this paper, we propose a novel scalable botnet detection system capable of detecting stealthy P2P botnets. Our system first identifies all hosts that are likely engaged in P2P communications. It then derives statistical fingerprints to profile P2P traffic and further distinguish between P2P botnet traffic and legitimate P2P traffic. The parallelized computation with bounded complexity makes scalability a built-in feature of our system. Extensive evaluation has demonstrated both high detection accuracy and great scalability of the proposed system.

근거리 통신망에서의 DDoS 봇넷 탐지 시스템 구현

단일 공격과 달리 DDoS 공격들은 네트워크에 분산된 봇넷이 동시에 타겟 서버에 공격을 개시한다. 이 경우 타겟 서버에서는 정상적인 사용자의 편의를 고려해야 하기 때문에 DDoS로 간주되는 패킷에 대하여 접속거부 조치를 취하기 어려운 점이 있다. 이를 고려하여 본 논문에서는 사용자 네트워크단위로 DDoS 공격을 탐지하고 네트워크 관리자가 조치를 취할 수 있도록 하여 전체적으로 봇넷의 규모를 줄여서 타겟 서버의 부담을 줄일 수 있는 DDoS 봇넷 탐지 시스템을 구현 하였다. 본 논문에서 제안한 DDoS 봇넷 탐지 시스템은 공격 트래픽의 시간 단위 흐름을 분석하고 수집한 이상상태에 대한 데이터베이스를 바탕으로 공격을 탐지 하도록 프로그램을 구현하였다. 그리고 패킷들의 평균개수와 표준편차를 이용하여 현재 트래픽의 임계치(Threshold)를 계산하고 이 임계치를 이용하여 DDoS 공격 여부를 판단하였다. 공격의 대상이 되는 서버를 중심으로 이루어졌던 봇넷 탐지 단위를 DDoS 봇에 감지된 공격 모듈이 속한 네트워크 단위 탐지로 전환함으로써 DDoS 공격에 대한 적극적인 방어의 개념을 고려해 볼 수 있었다. 따라서 DDoS와 DoS 공격의 차이점이라 할 수 있는 대규모 트래픽 흐름을 사전에 네트워크 관리자가 차단함으로써 봇넷의 규모를 축소시킬 수 있다. 또한, 라우터 장비 이하의 네트워크 통신에서 트래픽 공격을 사전에 차단할 수 있다면 타겟 서버의 부담뿐만 아니라 WAN 통신에서 라우터의 네트워크 부하를 상당부분 감소시킬 수 있는 효과를 얻을 수 있을 것으로 기대한다. Different Different from a single attack, in DDoS Attacks, the botnets that are distributed on network initiate attacks against the target server simultaneously. In such cases, it is difficult to take an action while denying the access of packets that are regarded as DDoS since normal user's convenience should also be considered at the target server. Taking these considerations into account, the DDoS botnet detection system that can reduce the strain on the target server by detecting DDoS attacks on each user network basis, and then lets the network administrator to take actions that reduce overall scale of botnets, has been implemented in this study. The DDoS botnet detection system proposed by this study implemented the program which detects attacks based on the database composed of faults and abnormalities collected through analyzation of hourly attack traffics. The presence of attack was then determined using the threshold of current traffic calculated with the standard deviation and the mean number of packets. By converting botnet-based detection method centering around the servers that become the targets of attacks to the network based detection, it was possible to contemplate aggressive defense concept against DDoS attacks. With such measure, the network administrator can cut large scale traffics of which could be referred as the differences between DDoS and DoS attacks, in advance mitigating the scale of botnets. Furthermore, we expect to have an effect that can considerably reduce the strain imposed on the target servers and the network loads of routers in WAN communications if the traffic attacks can be blocked beforehand in the network communications under the router equipment level.

Statistical Characterization of the Botnets C&C Traffic

Botnets are used for various purposes, most of them related to illegitimate activity, being also the sources of massive exploit activity as they recruit new vulnerable systems to expand their reach. Due to their volume, diverse capabilities and robustness, botnets pose a significant and growing threat to enterprise networks and to the Internet itself. Detecting botnets is a hard task and traditional network security systems are unable to successfully complete it. In fact, botnets are evolving and can be quite flexible: the protocols used for Command and Control (C&C) evolved from traditional IRC to others and the structure moved from centralized to distributed, using for example the Peer-to-Peer (P2P) communication paradigm. So, new generation botnet detection systems should be independent of the C&C protocol, botnet structure, infection model and resilient to the change of C&C server addresses. In addition, they should use all available information (from network probes, servers, routing elements, traffic statistics, identification of illicit applications), correlating it in the most useful way. Characterizing existing botnets is crucial to design and efficient detection methodology. Several approaches can be taken to study this phenomenon: analyze its source code, which can be a hard task mainly due to license restrictions; study of the botnet control, particularly the activity of its C&C server(s); study of the botnet behavior, namely its possible scanning activities, Denial of Service (DoS) attacks, spamming or phishing activities, among other possibilities. This work will mainly use the last two approaches to characterize (i) the traffic generated by each bot when communicating with the C&C server(s) and (ii) identify and analyze the main patterns of the botnet generated traffic.

A fuzzy pattern-based filtering algorithm for botnet detection

Botnet has become a popular technique for deploying Internet crimes. Although signature-based bot detection techniques are accurate, they could be useless when bot variants are encountered. Therefore, behavior-based detection techniques become attractive due to their ability to detect bot variants and even unknown bots. In this paper, we propose a behavior-based botnet detection system based on fuzzy pattern recognition techniques. We intend to identify bot-relevant domain names and IP addresses by inspecting network traces. If domain names and IP addresses used by botnets can be identified, the information can be further used to prevent protected hosts from becoming one member of a botnet. To work with fuzzy pattern recognition techniques, we design several membership functions based on frequently observed bots’ behavior including: (1) generate failed DNS queries; (2) have similar DNS query intervals; (3) generate failed network connections; and (4) have similar payload sizes for network connections. Membership functions can be easily altered, removed, or added to enhance the capability of the proposed system. In addition, to improve the overall system performance, we develop a traffic reduction algorithm to reduce the amount of network traffic required to be inspected by the proposed system. Performance evaluation results based on real traces show that the proposed system can reduce more than 70% input raw packet traces and achieve a high detection rate (about 95%) and a low false positive rates (0–3.08%). Furthermore, the proposed FPRF algorithm is resource-efficient and can identify inactive botnets to indicate potential vulnerable hosts.