P2P Botnet Detection Research Articles

PeerG: A P2P botnet detection method based on representation learning and graph contrastive learning

P2P botnets are distributed with complex topology and communication behavior, making them harder to detect and remove. Individuals or organizations can effectively detect P2P botnets by analyzing abnormal behaviors in network traffic. Existing works focus on extracting deterministic traffic interaction features, which are highly dependent on statistical features. Moreover, these methods are mainly aimed at generalized botnet detection and lack specificity for detecting P2P botnets. They ignore the topological information of P2P botnets, resulting in unsatisfactory detection accuracy. Among the few existing methods targeting P2P botnets, they consider the topological information but mainly rely on classical graph theory statistical features, such as degree, feature vector centrality, etc. This limits the generalization ability of the detection model. In this paper, we delve into the topological features of P2P botnets from the perspective of complex graph theory. We propose a P2P botnet detection method that combines representation learning and graph contrastive learning, dubbed PeerG. Specifically, we construct the communication graphs based on the flow interaction behavior between components of the P2P botnets. The Line algorithm is employed to embed the nodes of the communication graph into a low-dimensional representation vector space. Subsequently, the graph contrastive learning approach is utilized to optimize the feature extractor, enabling it to capture more representative node features. PeerG serves as a benchmark detection model for identifying P2P botnet nodes. Additionally, we devise two optimized contrastive detection strategies (PeerG-PreG and PeerG-PreF) based on graph-level and feature-level to boost the performance of PeerG. Extensive experiments demonstrate that PeerG brings significant improvements in detection accuracy over state-of-art detection methods. Furthermore, compared with PeerG, the detection strategies PeerG-PreG and PeerG-PreF have further improved detection performance, and achieve the best detection accuracy among multiple filtered P2P botnet types.

Intrusion Detection Systems: Enhancing Network Security in the Digital Age

In the era of cyber security threats, the botnet represents the extremely thoughtful threats being met by various organizations in recent times. It is reported that botnets are used to handle many cybercrimes recently. Though much research has been skilled in analyzing and detecting botnets, numerous challenges such as the ability to design detectors that deal with new forms of botnets stay unaddressed. In this thesis, I represent the work on the identification of Command & Control (2C) traffic of IRC-based botnets, HITP-based botnets, and P2P-based botnets using machine-learning-based classification techniques. Once identification of the bot is completed, the system will raise an alarm sound and also send a text note to the system administrator. The system administrator immediately performs the utmost needed security actions like blockage of the corresponding IP address, placing them under profound observation or interim over the same apprehensive network segments. The primary emphasis of this thesis is on, development of a system for the detection of P2P botnet from network traffic using 2 steps or phases namely P2P host detection and P2P botnet detection. The host-based approach is used for P2P host detection while P2P botnet detection uses a flow-based approach and accrued a combined accuracy of 99.98% for both phases. We also assessed the presence of the model developed on the offline network traffic and established a modest GUI-based engine that accepts the input as the host IP address and spots the hosts if any based on the botnet behavior. Based upon the key factors Bot Ransack is the system developed to detect IRC, HTTP, and P2P botnets. The results after several experiments illustrated the proposed system detects all the botnet IRC traffic and spots the affected hosts as well as the 2C server. During the implementation of Bot Ransack, the considered and finalized threshold values as 0.63, 0.61, and 0.62 for IRC botnet, HTTP botnet, and Peer to Peer botnet respectively for which the results showed earlier have illustrated the optimum performance which even compared with the earlier research work based on traditionally based botnet detection approaches. Even though there are other cyber-attacks taking place, one of the significant bot-based attacks is currently making headlines. The importance of botnets prompted researchers to study them and develop solutions to eliminate them. Peer-to-peer (P2P) architecture for botnets provides improved detection resistance over client-server architecture.

Detection of Peer-to-Peer Botnets using Graph Mining

Peer-to-Peer (P2P) botnets are significant threats to the Internet. The botnet traffic is increasing rapidly every year and impacts the entire Internet. A P2P botnet is responsible for launching various malicious activities such as DDoS attacks, click fraud attacks, stealing confidential information from bank and government websites, etc. It is challenging to detect P2P botnets because of their high resiliency against detection. This paper proposes a method that uses a network communication graph from network flow data to detect botnets. Three graph-mining techniques are used to detect bot nodes individually. The method's final result is obtained by applying an ensemble algorithm to the results of the three graph-mining techniques. A synthetic dataset from a testbed is used to assess the method's performance. In addition, the method is evaluated using a publicly available dataset. Experimental results show that the method performs with an accuracy of 99.99%, a precision of 94.29% ,and a recall of 98.02%, which is better than existing methods.

Detection of Peer-to-Peer Botnet Using Machine Learning Techniques and Ensemble Learning Algorithm

Peer-to-peer (P2P) botnet is one of the greatest threats to digital data. It has become a common tool for performing a lot of malicious activities such as DDoS attacks, phishing attacks, spreading spam, identity theft, ransomware, extortion attack, and many other fraudulent activities. P2P botnets are very resilient and stealthy and keep mutating to evade security mechanisms. Therefore, it has become necessary to identify and detect botnet flow from the normal flow. This paper uses supervised machine learning algorithms to detect P2P botnet flow. This paper also uses an ensemble learning technique to combine the performances of various supervised machine learning models to make predictions. To validate the results, four performance metrics have been used. These are accuracy, precision, recall, and F1-score. Experimental results show that the proposed approach delivers 99.99% accuracy, 99.81% precision, 99.11% recall, and 99.32% F1 score, which outperform the previous botnet detection approaches.

PeerAmbush: Multi-Layer Perceptron to Detect Peer-to-Peer Botnet

Due to emerging internet technologies that mostly depend on the decentralization concept, such as cryptocurrencies, cyber attackers also use the decentralization concept to develop P2P botnets. P2P botnets are considered one of the most serious and challenging threats to internet infrastructure security. Consequently, several open issues still need to be addressed, such as improving botnet intrusion detection systems, because botnet detection is essentially a confrontational problem. This paper presents PeerAmbush, a novel approach for detecting P2P botnets using, for the first time, one of the most effective deep learning techniques, which is the Multi-Layer Perceptron, with certain parameter settings to detect this type of botnet, unlike most current research, which is entirely based on machine learning techniques. The reason for employing machine learning/deep learning techniques, besides data analysis, is because the bots under the same botnet have a symmetrical behavior, and that makes them recognizable compared to benign network traffic. The PeerAmbush also takes the challenge of detecting P2P botnets with fewer selected features compared to the existing related works by proposing a novel feature engineering method based on Best First Union (BFU). The proposed approach showed considerable results, with a very high detection accuracy of 99.9%, with no FPR. The experimental results showed that PeerAmbush is a promising approach, and we look forward to building on it to develop better security defenses.

Revealing Influenced Selected Feature for P2P Botnet Detection

P2P botnet has become a serious security threat for computer networking systems. Botnet attack causes a great financial loss and badly impact the information and communication technology (ICT) system. Current botnet detection mechanisms have limitations and flaws to deal with P2P botnets which famously known for their complexity and scalable attack. Studies show that botnets behavior can be detected based on several detection features. However, some of the feature parameters may not represent botnet behavior and may lead to higher false alarm detection rate. In this paper, we reveal selected feature that influences P2P botnets detection. The result obtained by selecting features shows detection attack rate of 99.74%.

Peertrap: An Unstructured P2P Botnet Detection Framework Based on SAW Community Discovery

Botnet has become one of the serious threats to the Internet ecosystem, and botnet detection is crucial for tracking and mitigating network threats on the Internet. In the evolution of emerging botnets, peer-to-peer (P2P) botnets are more dangerous and resistant because of their distributed characteristics. Among them, unstructured P2P botnets use custom protocols for communication, which can be integrated with legitimate P2P traffic. Moreover, their topological structure is more complex, and a complete topology cannot be obtained easily, making them more concealed and difficult to detect. The bot itself is a kind of overlay network, and research shows that the nodes with shared neighbors usually belong to a certain community. Aiming at unstructured P2P botnets and exploiting complex network theory, from the perspective of shared neighbor nodes, this article proposes a botnet detection framework called Peertrap based on self-avoiding random walks (SAW) community detection under the condition of incomplete topological information. Firstly, network traffic is converted into Netflow, by utilizing Apache Flink big data platform. Also, a P2P traffic cluster feature extraction rule is proposed for distinguishing P2P traffic from non-P2P traffic, and it is formulated by using the upstream and downstream traffic and address distribution threshold features. Then, the confidence between P2P clusters is calculated by the Jaccard coefficient to construct a shared neighbor graph, and the same type of P2P communities are mined by hierarchical clustering using SAW algorithm combined with PCA. Finally, two community attributes, mean address distribution degree and mean closeness degree, are used to distinguish botnets. Experiments are conducted on three unstructured P2P botnets datasets, Sality, Kelihos, and ZeroAccess, and the CTU classic datasets, and then good detection results can be achieved. The framework overcomes one of the most critical P2P botnet detection challenges. It can detect P2P bots with high accuracy in the presence of legitimate P2P traffic, incomplete information network topology, and C&C channel encryption. Our method embodies the typical application of complex network theory in botnet detection field, and it can detect botnets from different families in the network, with good parallelism and scalability.

A two-phase sequential pattern mining framework to detect stealthy P2P botnets

The botnet has been one of the most common threats to network security. Among all emerged botnet, Peer to Peer (P2P) botnets are more perilous and resistant due to their distributed nature. In addition to their resiliency against takedown strategies, modern P2P botnets are stealthier in the way they perform fraudulent activities. One of the main challenges to detect P2P bots/botnets is the presence of benign P2P traffic. The botnet traffic can blend in with legitimate P2P traffic, and it makes the P2P bots stealthier. However, the problem of detecting P2P botnets in the presence of legitimate P2P traffic has received little attention from the research community.In this paper, a novel P2P botnet detection framework resilient to the presence of legitimate P2P traffic is proposed based on a two-phase Sequential Pattern Mining (SPM) approach. The proposed framework is evaluated in many different cases of the coexistence of P2P malicious and legitimate traffics, using real-world network traffic. Our experimental results show that the proposed framework is capable of detecting P2P bots in the presence of legitimate P2P traffic with a detection rate of 99.2%. Besides its accurate detection, our proposed framework is highly scalable and can detect even one bot in the network or different bots from different bot families.

On the resilience of P2P botnet footprints in the presence of legitimate P2P traffic

SummaryBotnet is a distributed platform for illegal activities severely threaten the security of the Internet. Fortunately, although their complicated nature, bots leave some footprints during the C&C communication that have been utilized by security researchers to design detection mechanisms. Nevertheless, botnet designers are always trying to evade detection systems by leveraging the legitimate P2P protocol as C&C channel or even mimicking legitimate peer‐to‐peer (P2P) behavior. Consequently, detecting P2P botnet in the presence of normal P2P traffic is one of the most challenging issues in network security. However, the resilience of P2P botnet detection systems in the presence of normal P2P traffic is not investigated in most proposed schemes. In this paper, we focused on the footprint as the most essential part of a detection system and presented a taxonomy of footprints utilized in behavioral P2P botnet detection systems. Then, the resilience of mentioned footprints is analyzed using three evaluation scenarios. Our experimental and analytical investigations indicated that the most P2P botnet footprints are not resilient to the presence of legitimate P2P traffic and there is a pressing need to introduce more resilient footprints.

Enhanced PeerHunter: Detecting Peer-to-Peer Botnets Through Network-Flow Level Community Behavior Analysis

Peer-to-peer (P2P) botnets have become one of the major threats in network security for serving as the fundamental infrastructure for various cyber-crimes. More challenges are involved in the problem of detecting P2P botnets, despite a few work claimed to detect centralized botnets effectively. We propose Enhanced PeerHunter, a network-flow level community behavior analysis based system, to detect P2P botnets. Our system starts from a P2P network flow detection component. Then, it uses "mutual contacts" to cluster bots into communities. Finally, it uses network-flow level community behavior analysis to detect potential botnets. In the experimental evaluation, we propose two evasion attacks, where we assume the adversaries know our techniques in advance and attempt to evade our system by making the P2P bots mimic the behavior of legitimate P2P applications. Our results showed that Enhanced PeerHunter can obtain high detection rate with few false positives, and high robustness against the proposed attacks.

P2P Botnet Detection Based on Nodes Correlation by the Mahalanobis Distance

Botnets are a common and serious threat to the Internet. The search for the infected nodes of a P2P botnet is affected by the number of commonly connected nodes, with a lower detection accuracy rate for cases with fewer commonly connected nodes. However, this paper calculates the Mahalanobis distance—which can express correlations between data—between indirectly connected nodes through traffic with commonly connected nodes, and establishes a relationship evaluation model among nodes. An iterative algorithm is used to obtain the correlation coefficient between the nodes, and the threshold is set to detect P2P botnets. The experimental results show that this method can effectively detect P2P botnets with an accuracy of >85% when the correlation coefficient is high, even in cases with fewer commonly connected nodes.

Adaptive traffic sampling for P2P botnet detection

SummaryPeer‐to‐peer (P2P) botnets have become one of the major threats to network security. Most existing botnet detection systems detect bots by examining network traffic. Unfortunately, the traffic volumes typical of current high‐speed Internet Service Provider and enterprise networks are challenging for these network‐based systems, which perform computationally complex analyses. In this paper, we propose an adaptive traffic sampling system that aims to effectively reduce the volume of traffic that P2P botnet detectors need to process while not degrading their detection accuracy. Our system first identifies a small number of potential P2P bots in high‐speed networks as soon as possible, and then samples as many botnet‐related packets as possible with a predefined target sampling rate. The sampled traffic then can be delivered to fine‐grained detectors for further in‐depth analysis. We evaluate our system using traffic datasets of real‐world and popular P2P botnets. The experiments demonstrate that our system can identify potential P2P bots quickly and accurately with few false positives and greatly increase the proportion of botnet‐related packets in the sampled packets while maintain the high detection accuracy of the fine‐grained detectors.

A Novel Botnet Detection System for P2P Networks

Botnets remain an active security problem on the Internet and various computer networks. They are continuously developing with regard to protocols, structure and quality of attacks. Many botnet detection programs are currently available, but only few can detect bots in real-time. The sooner bots are detected the lesser damage they can cause. In this paper, a novel botnet detection system, is proposed to detect peer-to-peer bots. The system consists of three-phases filtering, P2P detection and P2P botnet detection phases. For the third phase, P2P network behavior analysis is performed to detect P2P bots. Experimental results showed that the system exhibits high average true positive rate and extremely low average false positive rate during botnet detection.

Cyber pirating and Detection of malicious activities p2p botnets using Markov cluster algorithm

Cyber pirating and Detection of malicious activities p2p botnets using Markov cluster algorithm

Peer-to-Peer Botnet Detection based on Bot Behaviour

Peer-to-Peer (P2P) botnets are a significant threat to network security because of their distributed platform. The detection of these botnets becomes very difficult because of their decentralized nature and the situation worsens if an existing P2P network is exploited for botnetwork creation (parasite botnets). In this paper, we propose a two-tier detection framework to detect parasite P2P botnets. The approach can detect botnets in their waiting stage and without any requirement of bots’ signature. For detection of bots, we have considered two features: (i) long-living peers, search requests’ (ii) intensity and (iii) temporal correlated behaviour. The approach is able to detect bots from a monitored network with high detection accuracy. Keywords: peer-to-peer; botnets; botnet detection

A P2P Botnet detection scheme based on decision tree and adaptive multilayer neural networks

In recent years, Botnets have been adopted as a popular method to carry and spread many malicious codes on the Internet. These malicious codes pave the way to execute many fraudulent activities including spam mail, distributed denial-of-service attacks and click fraud. While many Botnets are set up using centralized communication architecture, the peer-to-peer (P2P) Botnets can adopt a decentralized architecture using an overlay network for exchanging command and control data making their detection even more difficult. This work presents a method of P2P Bot detection based on an adaptive multilayer feed-forward neural network in cooperation with decision trees. A classification and regression tree is applied as a feature selection technique to select relevant features. With these features, a multilayer feed-forward neural network training model is created using a resilient back-propagation learning algorithm. A comparison of feature set selection based on the decision tree, principal component analysis and the ReliefF algorithm indicated that the neural network model with features selection based on decision tree has a better identification accuracy along with lower rates of false positives. The usefulness of the proposed approach is demonstrated by conducting experiments on real network traffic datasets. In these experiments, an average detection rate of 99.08 % with false positive rate of 0.75 % was observed.

Noise-resistant mechanisms for the detection of stealthy peer-to-peer botnets

The problem of detection of malicious network traffic is adversarial in nature. Accurate detection of stealthy Peer-to-Peer botnets is an ongoing research problem. Past research on detection of P2P botnets has frequently used machine learning algorithms to build detection models. However, most prior work lacks the evaluation of such detection models in the presence of deliberate injection of noise by an adversary. Furthermore, detection of P2P botnets in the presence of benign P2P traffic has received little attention from the research community. This work proposes a novel approach for the detection of stealthy P2P botnets (in presence of benign P2P traffic) using conversation-based mechanisms and new features based on Fourier transforms and information entropy. We use real-world botnet data to compare the performance of our features with traditional ‘flow-based’ features employed by past research, and demonstrate that our approach is more resilient towards the injection of noise in the communication patterns by an adversary. We build detection models with multiple supervised machine learning algorithms. With our approach, we could detect P2P botnet traffic in the presence of injected noise with True Positive rate as high as 90%.

P2P and P2P botnet traffic classification in two stages

Nowadays accurate P2P traffic classification has become increasingly significant for network management. In addition, it is important to distinguish P2P botnet traffic from normal P2P traffic in order to find P2P malware and to immediately detect P2P botnets. Several approaches including port-based, signature-based, pattern-based, and statistics-based methods have been proposed to classify P2P and P2P botnet traffic. However, a single method alone cannot accurately classify both P2P and P2P botnet traffic. In this paper, we propose a hybrid traffic classifier that is composed of two stages. The first stage consists of a P2P traffic classifier that works in two steps. In the first step, a signature-based classifier is combined with connection heuristics, and in the second step, a statistics-based classifier is compensated by pattern heuristics. The statistics-based classifier is built using REPTree, a decision tree algorithm. The second stage is comprised of a P2P botnet traffic classifier that distinguishes P2P botnet traffic from other P2P traffic. The verification analysis and experiments using real datasets reveal that the proposed scheme provides a low overhead and achieves a high flow and byte accuracy of 97.70 and 97.06 % to classify P2P and P2P botnet traffic.

Detecting P2P botnet by analyzing macroscopic characteristics with fractal and information fusion

Towards the problems of existing detection methods, a novel real-time detection method (DMFIF) based on fractal and information fusion is proposed. It focuses on the intrinsic macroscopic characteristics of network, which reflect not the “unique” abnormalities of P2P botnets but the “common” abnormalities of them. It regards network traffic as the signal, and synthetically considers the macroscopic characteristics of network under different time scales with the fractal theory, including the self-similarity and the local singularity, which don't vary with the topology structures, the protocols and the attack types of P2P botnet. At first detect traffic abnormalities of the above characteristics with the nonparametric CUSUM algorithm, and achieve the final result by fusing the above detection results with the Dempster-Shafer evidence theory. Moreover, the side effect on detecting P2P botnet which web applications generated is considered. The experiments show that DMFIF can detect P2P botnet with a higher degree of precision.

PeerShark: flow-clustering and conversation-generation for malicious peer-to-peer traffic identification

The distributed and decentralized nature of peer-to-peer (P2P) networks has offered a lucrative alternative to bot-masters to build botnets. P2P botnets are not prone to any single point of failure and have been proven to be highly resilient against takedown attempts. Moreover, smarter bots are stealthy in their communication patterns and elude the standard discovery techniques which look for anomalous network or communication behavior. In this paper, we present a methodology to detect P2P botnet traffic and differentiate it from benign P2P traffic in a network. Our approach neither assumes the availability of any ‘seed’ information of bots nor relies on deep packet inspection. It aims to detect the stealthy behavior of P2P botnets. That is, we aim to detect P2P botnets when they lie dormant (to evade detection by intrusion detection systems) or while they perform malicious activities (spamming, password stealing, etc.) in a manner which is not observable to a network administrator. Our approach PeerSharkPeerShark combines the benefits of flow-based and conversation-based approaches with a two-tier architecture, and addresses the limitations of these approaches. By extracting statistical features from the network traces of P2P applications and botnets, we build supervised machine learning models which can accurately differentiate between benign P2P applications and P2P botnets. PeerSharkPeerShark could also detect unknown P2P botnet traffic with high accuracy.