Characteristics Of Botnets Research Articles

B-CAT: a model for detecting botnet attacks using deep attack behavior analysis on network traffic flows

AbstractThreats on computer networks have been increasing rapidly, and irresponsible parties are always trying to exploit vulnerabilities in the network to do various dangerous things. One way to exploit vulnerabilities in a computer network is by employing malware. Botnets are a type of malware that infects and attacks targets in groups. Botnets develop quickly; the characteristics of initially sporadic attacks have grown into periodic and simultaneous. This rapid development has proved that the botnet is advanced and requires more attention and proper handling. Many studies have introduced detection models for botnet attack activity on computer networks. Apart from detecting the presence of botnet attacks, those studies have attempted to explore the characteristics of botnets, such as attack intensity, relationships between activities, and time segment analysis. However, there has been no research that explicitly detects those characteristics. On the other hand, each botnet characteristic requires different handling, while recognizing the characteristics of the botnet can help network administrators make appropriate decisions. Based on these reasons, this research builds a detection model that can recognize botnet characteristics using sequential traffic mining and similarity analysis. The proposed method consists of two main processes. The first is training to build a knowledge base, and the second is testing to detect botnet activity and attack characteristics. It involves dynamic thresholds to improve the model sensitivity in recognizing attack characteristics through similarity analysis. The novelty includes developing and combining analytical techniques of sequential traffic mining, similarity analysis, and dynamic threshold to detect and recognize the characteristics of botnet attacks explicitly on actual behavior in network traffic. Extensive experiments have been conducted for the evaluation using three different datasets whose results show better performance than others.

Deep Graph Embedding for IoT Botnet Traffic Detection

Botnet attacks have mainly targeted computers in the past, which is a fundamental cybersecurity problem. Due to the booming of Internet of things (IoT) devices, an increasing number of botnet attacks are now targeting IoT devices. Researchers have proposed several mechanisms to avoid botnet attacks, such as identification by communication patterns or network topology and defence by DNS blacklisting. A popular direction for botnet detection currently relies on the specific topological characteristics of botnets and uses machine learning models. However, it relies on network experts’ domain knowledge for feature engineering. Recently, neural networks have shown the capability of representation learning. This paper proposes a new approach to extracting graph features via graph neural networks. To capture the particular topology of the botnet, we transform the network traffic into graphs and train a graph neural network to extract features. In our evaluations, we use graph embedding features to train six machine learning models and compare them with the performance of traditional graph features in identifying botnet nodes. The experimental results show that botnet traffic detection is still challenging even with neural networks. We should consider the impact of data, features, and algorithms for an accurate and robust solution.

Hybrid Machine Learning Technique to Detect Active Botnet Attacks for Network Security and Privacy

A botnet is a malware application controlled from a distance by a programmer with the assistance of a botmaster. Botnets can launch enormous cyber-attacks like Denial-of-Service (DOS), phishing, spam, data stealing, and identity theft. The botnet can also affect the security and privacy of the systems. The conventional approach to detecting botnets is made by signature-based analysis, which cannot discover botnets that are not visible. The behavior-based analysis appears to be an appropriate solution to the current botnet characteristics that are constantly developing. This paper aims to develop an efficient botnet detection algorithm using machine learning with traffic reduction to increase accuracy. Based on behavioural analysis, a traffic reduction strategy is applied to reduce network traffic to improve overall system performance. Several network devices are typically used to retrieve network traffic information. With a detection accuracy of 98.4%, the known and unknown botnet activities are measured using the supplied datasets. The machine learning-based traffic reduction system has achieved a high rate of traffic reduction, about 82%, and false-positive rates range between 0% to 2%. Both findings demonstrate that the suggested technique is efficient and accurate.

Automatic Botnet Attack Identification Based on Machine Learning

At present, the severe network security situation has put forward high requirements for network security defense technology. In order to automate botnet threat warning, this paper researches the types and characteristics of Botnet. Botnet has special characteristics in attributes such as packets, attack time interval, and packet size. In this paper, the attack data is annotated by means of string recognition and expert screening. The attack features are extracted from the labeled attack data, and then use K-means for cluster analysis. The clustering results show that the same attack data has its unique characteristics, and the automatic identification of network attacks is realized based on these characteristics. At the same time, based on the collection and attribute extraction of Botnet attack data, this paper uses RF, GBM, XGBOOST and other machine learning models to test the warning results, and automatically analyzes the attack by importing attack data. In the early warning analysis results, the accuracy rates of different models are obtained. Through the descriptive values of the three accuracy rates of Accuracy, Precision, and F1_Score, the early warning effect of each model can be comprehensively displayed. Among the five algorithms used in this paper, three have an accuracy rate of over 90%. The three models with the highest accuracy are used in the early warning model. The research shows that cyberattacks can be accurately predicted. When this technology is applied to the protection system, accurate early warning can be given before a network attack is launched.

A Hybrid Association Rule-Based Method to Detect and Classify Botnets

Nowadays, botnet has become a threat in the area of cybersecurity, and, worse still, it is difficult to be detected in complex network environments. Thus, traffic analysis is adopted to detect the botnet since this kind of method is practical and effective; however, the false rate is very high. The reason is that normal traffic and botnet traffic are quite close to the border, making it so difficult to be recognized. In this paper, we propose an algorithm based on a hybrid association rule to detect and classify the botnets, which can calculate botnets’ boundary traffic features and receive effects in the identification between normal and botnet traffic ideally. First, after collecting the data of different botnets in a laboratory, we analyze botnets traffic features by processing a data mining on it. The suspicious botnet traffic is filtered through DNS protocol, black and white list, and real-time feature filtering methods. Second, we analyze the correlation between domain names and IP addresses. Combining with the advantages of the existing time-based detection methods, we do a global correlation analysis on the characteristics of botnets, to judge whether the detection objects can be botnets according to these indicators. Then, we calculate these parameters, including the support, trust, and membership functions for association rules, to determine which type of botnet it belongs to. Finally, we process the test by using the public dataset and it turns out that the accuracy of our algorithm is higher.

Botnet Detection Method Based on Permutation Entropy and Clustering Variance

Fast developing network puts forward more complex requirements for detecting traffic abnormal behavior, but many existing methods cannot effectively curb the harm of botnet. This paper proposed a botnet detection method based on multidimensional permutation entropy and clustering variance. According to the traffic characteristics in the propagation period of bots, we used multidimensional permutation entropy to calculate the complexity of time series of network traffic, and then used cluster variance to detect the self similarity of permutation entropy model, finally the results proved the validity of this method. This method is based on the general characteristics of botnet, so we can detect all known and unknown botnets.

BotGuard: Lightweight real-time botnet detection in software defined networks

The distributed detection of botnets may induce heavy computation and communication costs to network devices. Each device in related scheme only has a regional view of Internet, so it is hard to detect botnet comprehensively. In this paper, we propose a lightweight real-time botnet detection framework called Bot-Guard, which uses the global landscape and flexible configurability of software defined network (SDN) to identify botnets promptly. SDN, as a new network framework, can make centralized control in botnet detection, but there are still some challenges in such detections. We give a convex lens imaging graph (CLI-graph) to depict the topology characteristics of botnet, which allows SDN controller to locate attacks separately and mitigate the burden of network devices. The theoretical and experimental results prove that our scheme is capable of timely botnet detecting in SDNs with the accuracy higher than 90% and the delay less than 56 ms.

Modeling and simulation of botnet based cyber-threats

The paper presents an analysis of cyber-threats, with particular emphasis on the threats resulting from botnet activity. Botnets are the most common types of threats and often perceived as crucial in terms of national security. Their classification and methods of spreading are the basis for creating cyberspace model including the presence of different types of cyber-threats. A well-designed cyberspace model enables to construct an experimental environment that allows for the analysis of botnet characteristics, testing its resistance to various events and simulation of the spread and evolution. For this purpose, dedicated platforms with capabilities and functional characteristics to meet these requirements have been proposed.

Detecting botnet by anomalous traffic

Botnets can cause significant security threat and huge loss to organizations, and are difficult to discover their existence. Therefore they have become one of the most severe threats on the Internet. The core component of botnets is their command and control channel. Botnets often use IRC (Internet Relay Chat) as a communication channel through which the botmaster can control the bots to launch attacks or propagate more infections. In this paper, anomaly score based botnet detection is proposed to identify the botnet activities by using the similarity measurement and the periodic characteristics of botnets. To improve the detection rate, the proposed system employs two-level correlation relating the set of hosts with same anomaly behaviors. The proposed method can differentiate the malicious network traffic generated by infected hosts (bots) from that by normal IRC clients, even in a network with only a very small number of bots. The experiment results show that, regardless the size of the botnet in a network, the proposed approach efficiently detects abnormal IRC traffic and identifies botnet activities.

P2P Botnet Detection Using Min-Vertex Cover

P2P botnet is one of the most critical threats to the current Internet security. In this paper, we propose a session-based analysis and minimum vertex cover mining detecting model for core nodes of P2P botnets. This model is focused on solving the core nodes of botnet and has a good performance when the characteristics of botnet are changed to avoid detecting. The simulation experiments reveal that when the session detection rate is at 50% and session falsepositive rate is at 29%, the core node detection rate still remains 98.9%, and the false-positive rate of core node is only 4.87%.

Research on Botnet Mechanisms and Defenses

以僵尸网络为载体的各种网络攻击活动是目前互联网所面临的最为严重的安全威胁之一.虽然近年来这方面的研究取得了显著的进展,但是由于僵尸网络不断演化、越来越复杂和隐蔽以及网络和系统体系结构的限制给检测和防御带来的困难,如何有效应对僵尸网络的威胁仍是一项持续而具有挑战性的课题.首先从僵尸网络的传播、攻击以及命令与控制这3 个方面介绍了近年来僵尸网络工作机制的发展,然后从监测、工作机制分析、特征分析、检测和主动遏制这5 个环节对僵尸网络防御方面的研究进行总结和分析,并对目前的防御方法的局限、僵尸网络的发展趋势和进一步的研究方向进行了讨论.;Botnets are one of the most serious threats to the Internet. Researchers have done plenty of research and made significant progress. However, botnets keep evolving and have become more and more sophisticated. Due to the underlying security limitation of current system and Internet architecture, and the complexity of botnet itself, how to effectively counter the global threat of botnets is still a very challenging issue. This paper first introduces the evolving of botnet’s propagation, attack, command, and control mechanisms. Then the paper summarizes recent advances of botnet defense research and categorizes into five areas: Botnet monitoring, botnet infiltration, analysis of botnet characteristics, botnet detection and botnet disruption. The limitation of current botnet defense techniques, the evolving trend of botnet, and some possible directions for future research are also discussed.

Research on New Botnet Detection Strategy Based on Information Materials

Recognized as one the most serious security threats on current Internet infrastructure, botnets with its low resource requirements have developed rapidly. How to detect botnets has become a major topic of current research. Based on existing research results, this paper proposes a new detection strategy, which solves unknown botnet detection efficiency by the behavioral characteristics of botnets. The core idea is separating static characteristic and dynamic behavior of botnet, and optimizing dynamic the parameters of dynamic behavior, and changing passive defense into active defense. According to the behavior of the attacker, this strategy can optimize behavior parameters. The proposed approach has the commonality and the expansibility, which strengthen unknown botnet defense fundamentally.

Analysis on the time-domain characteristics of botnets control traffic

Botnets are networks composed with malware-infect ed computers. They are designed and organized to be controlled by an adversary. As victims are infected through their inappropriate network behaviors in most cases, the Internet protocol (IP) addresses of infected bots are unpredictable. Plus, a bot can get an IP address through dynamic host configuration protocol (DHCP), so they need to get in touch with the controller initiatively and they should attempt continuously because a controller can't be always online. The whole process is carried out under the command and control (C&C) channel. Our goal is to characterize the network traffic under the C&C channel on the time domain. Our analysis draws upon massive data obtained from honeynet and a large Internet service provider (ISP) Network. We extract and summarize fingerprints of the bots collected in our honeynet. Next, with the fingerprints, we use deep packet inspection (DPI) Technology to search active bots and controllers in the Internet. Then, we gather and analyze flow records reported from network traffic monitoring equipments. In this paper, we propose a flow record interval analysis on the time domain characteristics of botnets control traffic, and we propose the algorithm to identify the communications in the C&C channel based on our analysis. After that, we evaluate our approach with a 3.4 GB flow record trace and the result is satisfactory. In addition, we believe that our work is also useful information in the design of botnet detection schemes with the deep flow inspection (DFI) technology.