Botnet Research Articles

Botnet detection in the internet-of-things networks using convolutional neural network with pelican optimization algorithm

Hackers nowadays employ botnets to undertake cyberattacks towards the Internet of Things (IoT) by illegally exploiting the scattered network’s resources of computing devices. Several Machine Learning (ML) and Deep Learning (DL) methods for detecting botnet (BN) assaults in IoT networks have recently been proposed. However, in the training set, severely imbalanced network traffic data degrades the classification performances of state-of-the-art ML as well as DL algorithm, particularly in classes with very few samples. The Convolutional Neural Network -Pelican Optimization System (CNN-POA) is a DL relied botnet attack detection algorithm developed in this research. Meanwhile, typical evaluation markers are used to compare the overall performance of the proposed CNN-POA and additional frequently employed algorithms. The simulation results suggest that the CNN-POA method is effective and dependable for detecting IoT network intrusion attacks. Experiments revealed that the suggested CNN-POA approach outperformed a number of current metaheuristic algorithms, with an accuracy of 99.5%.

ZeroAccess botnet investigation and analysis

ZeroAccess botnet investigation and analysis

Survey on Botnet and Its Detection Techniques

Survey on Botnet and Its Detection Techniques

İkili Gri Kurt Optimizasyonu (BGWO) ve Naive Bayes (NB) Kullanılarak Yeni Bir Hibrit IoT Tabanlı IDS

Akilli ortamlarin temel amaclarindan biri, verimlilik ve konfor acisindan insan yasam standardinin kalitesini yukseltmektir. Nesnelerin Interneti (IoT) modeli, akilli ortamlar olusturmak icin yeni teknolojiye donusmustur. IoT, diger cihazlarla bilgi alisverisi yapabilen fiziksel esyalar veya cihazlari ifade etmektedir. Akilli ev, akilli sehir, endustriyel kontrolu, otomobil endustrisi, tarim, akilli ulasim, ev otomasyonu ve aletleri, saglik gibi cesitli alanlarda ve daha bircok alanda kullanilmaktadir. Dahasi, yenilikci is paradigmalarini ve gelismis kullanici deneyimini garanti etmektedir. Gizlilik ve guvenlik, IoT paradigmasina dayali herhangi bir gercek dunya akilli ortaminda temel sorunlar olarak kabul edilmektedir. Bu nedenle, IoT sistemlerinin guvenligini uygulamak, IoT aglarinin basarili dagitiminda birinci oncelik ve buyuk ilgi alani haline gelmektedir. IoT ile ilgili sistemlerdeki acik guvenlik delikleri, akilli uygulamalari etkileyen guvenlik riskleri olusturur. Mirai botnet son zamanlarda baslatilan yeni saldirilardan bir ornektir. IoT agi, kimlik dogrulama ve sifreleme ile korunmaktadir. ancak kotu niyetli ve zararli saldirilara karsi hafifletemez. Bu nedenle saldirilari tespit etmek icin IoT tabanli Saldiri Tespit Sistemi (IDS) gerekmektedir. Bu makalede, IoT agindaki saldirilari savunmak ve guvenlemek icin ikili Gri Kurt Optimizasyonu (BGWO) ve Naive Bayes (NB) kullanilarak yeni bir hibrit IoT tabanli IDS sunulmustur. BGWO, ozellik secimi olarak ve NB de siniflandirma yontemi olarak kullanilmistir. Sonuclar diger optimizasyon algoritmalariyla karsilastirilmistir. IoT-botnet veri kumesi, deneysel bir veri kumesi olarak kullanilmistir.

Methods for detecting bot nets in computer systems

Object. The process of the botnets detection in the corporate area networks based on network traffic analysis and on the of computer systems software’s behavior. Subject. Methods for botnets detection in computer systems. Goal. Increasing of the botnet detection efficiency by developing new methods for its detection in the corporate networks. Results. A new approach for the botnet detection in the corporate area networks based on the analysis of the bots’ behavior is proposed. The detection of botnets is accomplished by applying the developed two methods: by means of network-level and host-level analysis. The first method allows you to analyze the behavior of the software on the host, which may indicate the possible presence of the bot directly on the host and the detection of malicious software, while the second method involves monitoring and analysis of DNS traffic, which also allows to make a conclusion about infection of network hosts with botnets. Based on the proposed methods, an effective tool for botnet detection - BotGRABBER - was developed. It is capable of detecting bots that use such evasion methods as IP mapping, fast flux, domain flux, and DNS tunneling. Conclusions. The usage of the developed system allows to detect the hosts infected with botnet and localize malware with high efficiency - up to 96%, and also shows low rate of false positives 3-5%. A feature of the proposed approach is that the detection of botnets is "invisible" to botnet owners.

An Approach for BOT NET in Data Mining

An Approach for BOT NET in Data Mining

Bot Net of Things – A Survey

Internet of things is talk of the town now a days but the potential threat IoT has over the cyber safety is less emphasized. The possibility for attackers with all systems interconnected with no or less security measures installed in them, makes them vulnerable to all kinds of security attacks. Botnet consists of collection of private computers interconnected together and affected by malicious software, which can be controlled as a group without the owner’s knowledge. BotNet is roBot and Network combination, the bot here is the compromised device. Denial of service, spyware, email spam, click fraud, bit coin etc., and are some of the well-known attacks by botnet. Botnet control itself has become a community, which focuses on prevention, control and repair services. This paper focuses on detailed survey of botnet and it’s regarding features.

A training-resistant anomaly detection system

Modern network intrusion detection systems rely on machine learning techniques to detect traffic anomalies and thus intruders. However, the ability to learn the network behaviour in real-time comes at a cost: malicious software can interfere with the learning process, and teach the intrusion detection system to accept dangerous traffic. This paper presents an intrusion detection system (IDS) that is able to detect common network attacks including but not limited to, denial-of-service, bot nets, intrusions, and network scans. With the help of the proposed example IDS, we show to what extent the training attack (and more sophisticated variants of it) has an impact on machine learning based detection schemes, and how it can be detected.

Peer-to-Peer Botnet Detection based on Bot Behaviour

Peer-to-Peer (P2P) botnets are a significant threat to network security because of their distributed platform. The detection of these botnets becomes very difficult because of their decentralized nature and the situation worsens if an existing P2P network is exploited for botnetwork creation (parasite botnets). In this paper, we propose a two-tier detection framework to detect parasite P2P botnets. The approach can detect botnets in their waiting stage and without any requirement of bots’ signature. For detection of bots, we have considered two features: (i) long-living peers, search requests’ (ii) intensity and (iii) temporal correlated behaviour. The approach is able to detect bots from a monitored network with high detection accuracy. Keywords: peer-to-peer; botnets; botnet detection

English

English

Partitioning of Resource Provisions for Cloud Computing Infrastructure against DoS and DDoS Attacks

The Internet is growing to become a necessary and indispensable tool for the common man. Security has remained a hindrance to reaping the full, immense benefits of the Internet. Cybercrimes have been on the rise, and are becoming even easier to perpetrate even for the unskilled and naive users. Denial of Service (DoS) is becoming one of the most common and most devastating of known cybercrimes that leave huge financial losses in its wake, with possibilities ofeven loss of lives in developed countries. This research proposes a model for partitioning of resource provisions in cloud computing infrastructure, as a means of mitigating against DoS attacks, especially at the Application Layer. This model focuses on securing critical computing resources of cloud computing infrastructure by providing different resource pools for servicing requests of applications and processes whose resource consumption levels are within safe limits, and for those that are suspected to be headed for a DoS. A full theoretical framework for this model is established with the use of an algorithm, a flowchart and a functional flow block diagram (FFBD). Keywords: Virtualization, Cloud Computing, Resource Allocation, Denial of Service, Botnets, Functional Flow Block Diagrams.

A REVIEW OF PEER-TO-PEER BOTNET DETECTION TECHNIQUES

In recent years, Peer-to-Peer technology has an ext ensive use. Botnets have exploited this technology efficiently and introduced the P2P botnet, which us es P2P network for remote control of its bots and become one of the most significant threats to compu ter networks. They are used to make DDOS attacks, generate spam, click fraud and steal sensitive info rmation. Compared with traditional botnets, P2P bot nets are harder to be defended and hijacked. In this stu dy we discuss various P2P botnet detection approaches and evaluate their effectiveness. We identify the advantages and shortcomings of each of the discussed techniques. This can guide the researchers to a bet ter understanding of P2P botnets and easier for the m developing more sufficient detection techniques. Ou r evaluation shows that each technique has its own advantages and limitations. Two or more detection t echniques might be used together, in order to have a robust P2P botent detection.

Analysis and Improvement Design on P2P Botnets Detection Framework

Developing the P2P botnets detection framework is crucial when we trying to fight against P2P botnets. Poor detection method can lead to a failure of P2P botnets detection. Thus, it needs to be accurately functioned well. This paper reviews and evaluates various current frameworks of P2P botnets detection and analyzing the existing gaps to make improvement of P2P botnets detection framework. Based on a review that conducted manually, we report our findings and analysis has been done on different frameworks concern on P2P botnets detection. Consequently, the gap and motivations found from this reviews are discussed. Then, the P2P botnets detection framework architecture has been proposed with the new improvement been reinforced by hybrid detection technique, hybrid analyzer and in-depth hybrid analysis. Future directions of this review are to develop the P2P botnets detection system that has capability in high detection accuracy and efficiency.

A novel method of mining network flow to detect P2P botnets

Botnets are a serious threat to cyber-security. As a consequence, botnet detection has become an important research topic in network protection and cyber-crime prevention. P2P botnets are one of the most malicious zombie networks, as their architecture imitates P2P software. Characteristics of P2P botnets include (1) the use of multiple controllers to avoid single-point failure; (2) the use of encryption to evade misuse detection technologies; and (3) the capacity to evade anomaly detection, usually by initiating numerous sessions without consuming substantial bandwidth. To overcome these difficulties, we propose a novel data mining method. First, we identify the differences between P2P botnet behavior and normal network behavior. Then, we use these differences to tune the data-mining parameters to cluster and distinguish normal Internet behavior from that lurking P2P botnets. This method can identify a P2P botnet without breaking the encryption. Furthermore, the detection system can be deployed without altering the existing network architecture, and it can detect the existence of botnets in a complex traffic mix before they attack. The experimental results reveal that the method is effective in recognizing the existence of botnets. Accordingly, the results of this study will be of value to information security academics and practitioners.

Botnet Detecting Method Based on Clustering Flow Attributes of Command and Control Communication Channel

僵尸网络(Botnet)是一种从传统恶意代码形态进化而来的新型攻击方式，为攻击者提供了隐匿、灵活且高效的一对多命令与控制信道(Command and Control channel, CC)机制，可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾邮件发送等攻击目的。该文提出一种与僵尸网络结构和CC协议无关，不需要分析数据包的特征负载的僵尸网络检测方法。该方法首先使用预过滤规则对捕获的流量进行过滤，去掉与僵尸网络无关的流量；其次对过滤后的流量属性进行统计；接着使用基于X-means聚类的两步聚类算法对CC信道的流量属性进行分析与聚类，从而达到对僵尸网络检测的目的。实验证明，该方法高效准确地把僵尸网络流量与其他正常网络流量区分，达到从实际网络中检测僵尸网络的要求，并且具有较低的误判率。

Wins and losses in the war on botnets

Wins and losses in the war on botnets

Reality of botnet cyberwarfare

Whoever knows isn't talking.

BBC creates a botnet of 22 000 PCs in investigation

BBC creates a botnet of 22 000 PCs in investigation

PayPal, FBI and others wage war on Botnet armies. Can they succeed?

Botnets subsume other threats such as DDOS, spam and phishing fraud. Philip Hunter reports.

Strategy in the media

Purpose – Over a two‐month period, the editor of this media review has searched worldwide for the most interesting and useful articles, blogs and books on the topic of strategic management.Design/methodology/approach – In addition to his own finds, the editor sorted through suggestions by a team of veteran top managers and senior academics.Findings – The result is a surprisingly diverse set of media articles about strategy and leadership on such topics as brand bruising, executive compensation at Detroit automakers, walled garden idea, Russian high‐tech boom, botnets threat, new LBO worker/management model, downsizing as restoration, four principles of luxury brands, growing economic ties between Asia and the Middle East, Indian automaker confront deregulation, addressing and adapting to global warming, commoditizing the Starbucks brand, Silicon Valley's geographical advantage, collaborative networks, new pricing strategies, dollar's reserve‐currency status.Practical implications – URL links and reference...