Botnet Detection Research Articles

AppCon: Mitigating Evasion Attacks to ML Cyber Detectors

Adversarial attacks represent a critical issue that prevents the reliable integration of machine learning methods into cyber defense systems. Past work has shown that even proficient detectors are highly affected just by small perturbations to malicious samples, and that existing countermeasures are immature. We address this problem by presenting AppCon, an original approach to harden intrusion detectors against adversarial evasion attacks. Our proposal leverages the integration of ensemble learning to realistic network environments, by combining layers of detectors devoted to monitor the behavior of the applications employed by the organization. Our proposal is validated through extensive experiments performed in heterogeneous network settings simulating botnet detection scenarios, and consider detectors based on distinct machine- and deep-learning algorithms. The results demonstrate the effectiveness of AppCon in mitigating the dangerous threat of adversarial attacks in over 75% of the considered evasion attempts, while not being affected by the limitations of existing countermeasures, such as performance degradation in non-adversarial settings. For these reasons, our proposal represents a valuable contribution to the development of more secure cyber defense platforms.

Crisis Management of Android Botnet Detection Using Adaptive Neuro-Fuzzy Inference System

Android has become a leader in market share of mobile operating systems. In addition, it has attracted interest of attackers greater than other running systems. As a result, Android malware is developing rapidly. In this study, the foremost focal point is on inspecting and detecting botnets that are particular type of malwares. To analyze android botnet detection, it is appropriate to pick out and analyze elements which are enormously applicable or most influential to the botnet detection. This technique typically named variable determination is corresponds to determine a subset of complete recorded variables which presents favorable predictions capability. In this research work, architecture based totally upon adaptive neuro-fuzzy inference system (ANFIS) is used to model complex systems in function approximation and regression. ANFIS community is employed to operate variable selection for identifying that how the botnet have an effect on the android. After deciding on the two most influential parameters, the ANFIS is utilized to create a machine for android botnet detection on the foundation of the chosen parameters.

Erdos Renyi Random Graph a nd Machine Learning Based Botnet Detection

Basically large networks are prone to attacks by bots and lead to complexity. When the complexity occurs then it is difficult to overcome the vulnerability in the network connections. In such a case, the complex network could be dealt with the help of probability theory and graph theory concepts like Erdos – Renyi random graphs, Scale free graph, highly connected graph sequences and so on. In this paper, Botnet detection using Erdos – Renyi random graphs whose patterns are recognized as the number of connections that the vertices and edges made in the network is proposed. This paper also presents the botnet detection concepts based on machine learning.

A Three Stage Botnet Detection Technique using Random and Obrazom Graph s

This paper proposes three-stage botnet detection technique based on the anomaly and community detection. The first stage is a pragmatic node based distributed approach of sparse graph sequences. The second stage detects the bot from sparse matrix and correlations of interactions among the node. In the third stage, random graph is evaluating the performance of the bots and verified with both odd and even types of nodes. The same is extended and verified through Obrazom triple connected graphs. This verification is helpful to identify the aggressive bots through the optimized pivotal nodes. Machine Learning based Botnet Detection techniques are implemented in various levels like centralized and distributed level of networks. We can apply this three-stage bot detection in large-scale data.

A smart adaptive particle swarm optimization–support vector machine: android botnet detection application

Support vector machine (SVM) is a renowned machine learning technique, which has been successfully applied to solve many practical pattern classification problems. One of the difficulties in successful implementation of SVM is its different parameters (i.e., kernel parameter(s), penalty parameter (C) and the features available in the dataset), which should be well adjusted during the training process. In this paper, a new approach called smart adaptive particle swarm optimization–support vector machine (SAPSO–SVM) is developed to adapt the parameters of optimization algorithm (i.e., inertia weight and acceleration coefficients) to the latest changes in the search space, so that each particle explicitly explores the search space based on the latest changes made to Personal best, Global best and other particle locations. In this algorithm, using the changes in Personal best and Global best at each stage of execution, the new evolution factor values are designated and the interference of the intervals of inertia weight is eradicated. Then, the states of each particle (i.e., convergence, exploitation, exploration, jumping-out) at each stage of administration, based on the interval weights, are specified accurately. By fine tuning the parameters of SAPSO, this algorithm can acquire the best optimal responses for SVM parameters. The results obtained from the SAPSO–SVM method demonstrate the superiority of this method in four different measures (i.e., sensitivity, specificity, precision, accuracy) in comparison with the other three similar ones. Finally, the top 20 features of Android botnets are somehow introduced by the proposed approach and three other approaches; firstly, these features are not encrypted by Android botnets, and secondly, are selected based on the best results.

Botnet Forensic Analysis Using Machine Learning

Botnet forensic analysis helps in understanding the nature of attacks and the modus operandi used by the attackers. Botnet attacks are difficult to trace because of their rapid pace, epidemic nature, and smaller size. Machine learning works as a panacea for botnet attack related issues. It not only facilitates detection but also helps in prevention from bot attack. The proposed inquisition model endeavors improved quality of results by comprehensive botnet detection and forensic analysis. This scenario has been applied in eight different combinations of ensemble classifier technique to detect botnet evidence. The study is also compared to the ensemble-based classifiers with the single classifier using different parameters. The results exhibit that the proposed model can improve accuracy over a single classifier.

Detecting botnet by using particle swarm optimization algorithm based on voting system

Botnets have recently been identified as serious Internet threats that are continually developing and expanding. Identifying botnets in the domain of network security is regarded as a new challenge and topic for research. There are several methods for detecting botnets in networks, and prior research has encountered problems, including a high error and inaccuracy in detection. In this paper, the botnet detection method by using a hybrid of particle swarm optimization (PSO) algorithm with a voting system (BD-PSO-V) was used to improve the challenges of previous studies. The PSO algorithm was employed to select outstanding and effective features in the detection of botnets. The voting system, including a deep neural network algorithm, support vector machine (SVM), and decision tree C4.5, were utilized to identify botnets and classify samples. The decision-making strategy of the voting system was based on maximum votes, and the most important innovation of this research was to combine the PSO feature selection algorithm with a voting system using deep learning to identify botnets. Two datasets, ISOT and Bot-IoT, were employed to further verify the BD-PSO-V system performance. BD-PSO-V simulation improved the accuracy by an average of ∼0.42% and 0.17% in the ISOT dataset and the Bot-IoT dataset, respectively, compared to the other methods investigated. In addition, the effect of six well-known adversarial attacks on both datasets was evaluated. Despite a slight drop in accuracy rate, BD-PSO-V results had a promising performance against a variety of attacks.

Withdrawal Notice: BotGuard: Clustering and correlation of network traffic for Botnet detection

The article has been withdrawn at the request of the authors and editor of the journal Recent Advances in Computer Science and Communications.; The Bentham Editorial Policy on Article Withdrawal can be found at https://benthamscience.com/editorial-policies-main.php Bentham Science Disclaimer: It is a condition of publication that manuscripts submitted to this journal have not been published and will not be simultaneously submitted or published elsewhere. Furthermore, any data, illustration, structure or table that has been published elsewhere must be reported, and copyright permission for reproduction must be obtained. Plagiarism is strictly forbidden, and by submitting the article for publication the authors agree that the publishers have the legal right to take appropriate action against the authors, if plagiarism or fabricated information is discovered. By submitting a manuscript the authors agree that the copyright of their article is transferred to the publishers if and when the article is accepted for publication.

Hybrid Botnet Detection Based on Host and Network Analysis

Botnet is one of the most dangerous cyber-security issues. The botnet infects unprotected machines and keeps track of the communication with the command and control server to send and receive malicious commands. The attacker uses botnet to initiate dangerous attacks such as DDoS, fishing, data stealing, and spamming. The size of the botnet is usually very large, and millions of infected hosts may belong to it. In this paper, we addressed the problem of botnet detection based on network’s flows records and activities in the host. Thus, we propose a general technique capable of detecting new botnets in early phase. Our technique is implemented in both sides: host side and network side. The botnet communication traffic we are interested in includes HTTP, P2P, IRC, and DNS using IP fluxing. HANABot algorithm is proposed to preprocess and extract features to distinguish the botnet behavior from the legitimate behavior. We evaluate our solution using a collection of real datasets (malicious and legitimate). Our experiment shows a high level of accuracy and a low false positive rate. Furthermore, a comparison between some existing approaches was given, focusing on specific features and performance. The proposed technique outperforms some of the presented approaches in terms of accurately detecting botnet flow records within Netflow traces.

RETRACTED ARTICLE: Multi feature behavior approximation model based efficient botnet detection to mitigate financial frauds

Money laundering and other financial frauds are increasing day by day and the financial industries face various challenges from them. They construct botnets to generate such fraudulent attacks towards financial sectors. To mitigate such threats and detect the presence of botnet, different solutions have been arrived earlier. But they struggle to achieve higher performance in detecting such botnet and restrict them from fraudulent transactions. To improve the performance, a novel multi feature behavior approximation algorithm has been presented in this article. The multi feature behavior approximation algorithm monitors each transaction performed by different users, their behavior in accessing service, the status of service access and so on. This botnet detection scheme monitors the behaviors of users and intermediate nodes involved in each transaction. Using the trace, the method performs behavior approximation in two ways like source orient and intermediate orient. In both the scheme, the method considers the frequency of transactions, their status, completion, the intermediate nodes involved and their reputation. Using all these, multi feature trust measure (MFTS) is estimated. Based on the value of MFTS, the method detects the presence of botnet and mitigates them by eliminating the node according to the backward trust score. The transaction has been accepted only when the backward trust score is high enough. The proposed algorithm improves the performance of botnet detection and reduces the frequency of money laundering.

PSI-rooted subgraph: A novel feature for IoT botnet detection using classifier algorithms

Abstract It is obvious that IoT devices are widely used more and more in many areas. However, due to limited resources (e.g., memory, CPU), the security mechanisms on many IoT devices such as IP-Camera, router are low. Therefore, botnets are an emerging threat to compromise IoT devices recently. To tackle this, a novel method for IoT botnets detection plays a crucial role. In this paper, we have some contributions for IoT botnet detection: first, we present a novel high-level PSI-rooted subgraph-based feature for the detection of IoT botnets; second, we generate a limited number of features that have precise behavioral descriptions, which require smaller space and reduce processing time; third, The evaluation results show the effectiveness and robustness of PSI-rooted subgraph-based features, as with five machine classifiers consisting of Random Forest, Decision Tree, Bagging, k-Nearest Neighbor, and Support Vector Machine, each classifier achieves more than 97% detection rate and low time-consuming. Moreover, compared to other work, our proposed method obtains better performance. Finally, we publicize all our materials on Github, which will benefit future research (e.g., IoT botnet detection approach).

A Framework for Detecting Botnet Command and Control Communication over an Encrypted Channel

Botnet employs advanced evasion techniques to avoid detection. One of the Botnet evasion techniques is by hiding their command and control communication over an encrypted channel like SSL and TLS. This paper provides a Botnet Analysis and Detection System (BADS) framework for detecting Botnet. The BADS framework has been used as a guideline to devise the methodology, and we divided this methodology into six phases: i. data collection, customization, and conversion, ii. feature extraction and feature selection, iii. Botnet prediction and classification, iv. Botnet detection, v. attack notification, and vi. testing and evaluation. We tend to use the machine learning algorithm for Botnet prediction and classification. We also found several challenges in implementing this work. This research aims to detect Botnet over an encrypted channel with high accuracy, fast detection time, and provides autonomous management to the network manager.

A Review on Honeypot-based Botnet Detection Models for Smart Factory

Since the Swiss Davos Forum in January 2017, the most searched keywords related to the Fourth Revolutionary Industry are AI technology, big data, and IoT. In particular, the manufacturing industry seeks to advance information and communication technology (ICT) to build a smart factory that integrates the management of production processes, safety, procurement, and logistics services. Such smart factories can effectively solve the problem of frequent occurrences of accidents and high fault rates. An increasing number of cases happening in smart factories due to botnet DDoS attacks have been reported in recent times. Hence, the Internet of Thing security is of paramount importance in this emerging field of network security improvement. In response to the cyberattacks, smart factory security needs to gain its defending ability against botnet. Various security solutions have been proposed as solutions. However, those emerging approaches to IoT security are yet to effectively deal with IoT malware, also known as Zero-day Attacks. Botnet detection using honeypot has been recently studied in a few researches and shows its potential to detect Botnet in some applications effectively. Detecting botnet by honeypot is a detection method in which a resource is intentionally created within a network as a trap to attract botnet attackers with the purpose of closely monitoring and obtaining their behaviors. By doing this, the tracked contents are recorded in a log file. It is then used for analysis by machine learning. As a result, responding actions are generated to act against the botnet attack. In this work, a review of literature looks insight into two main areas, i.e. 1) Botnet and its severity in cybersecurity, 2) Botnet attacks on a smart factory and the potential of the honeypot approach as an effective solution. Notably, a comparative analysis of the effectiveness of honeypot detection in various applications is accomplished and the application of honey in the smart factories is reviewed.

A real-time botnet detection model based on an efficient wrapper feature selection method

Botnets are one of the most widespread and serious threats of cybersecurity that have infected millions of computers around the world over the past few years. Previous research has shown that machine learning methods can accurately detect botnet attacks. However, these methods often do not address the problem of real-time botnet detection, which is one of the main challenges in this area and is essential to prevent the damage caused by botnet attacks. This paper aims to present an efficient real-time model for botnet detection. In the proposed method, a subset of the effective features in detecting the bot traffic is initially selected using the world competitive contests algorithm. Then, based on the selected features, a support vector machine model is created offline to detect real-time bot traffic from the normal one. The test results show that the proposed method can detect botnets with 95% accuracy and outperforms other methods.

A real-time botnet detection model based on an efficient wrapper feature selection method

Botnets are one of the most widespread and serious threats of cybersecurity that have infected millions of computers around the world over the past few years. Previous research has shown that machine learning methods can accurately detect botnet attacks. However, these methods often do not address the problem of real-time botnet detection, which is one of the main challenges in this area and is essential to prevent the damage caused by botnet attacks. This paper aims to present an efficient real-time model for botnet detection. In the proposed method, a subset of the effective features in detecting the bot traffic is initially selected using the world competitive contests algorithm. Then, based on the selected features, a support vector machine model is created offline to detect real-time bot traffic from the normal one. The test results show that the proposed method can detect botnets with 95% accuracy and outperforms other methods.

A Distributed Architecture for DDoS Prediction and Bot Detection

Distributed Denial-of-Service (DDoS) attacks disrupt servers, services and the network, overloading the target resources and denying normal traffic. In order to defend from this attack, mitigation actions usually overprovision and sinkhole malicious traffic. Sooner the attack is detected, better is the mitigation. Hence, we advocate for using a prediction technique aiming to anticipate actions against the possible attack, before it effectively starts. Then, this article contributes to advance the state-of-the-art presenting a distributed architecture that identifies early signals of a possible DDoS attack and detects bots composing a botnet. The architecture identifies the malicious actors (bots) participating in the attack. The bot detection technique is triggered by the prediction of DDoS supported by early signals. Prediction identifies signals of attack on the network before it reaches advanced stages. Based on the metastability theory, it provides unsupervised statistical learning and identifies the imminence of DDoS attacks. The botnet detection is challenging because of the high dimension of data involved and because of resource constraints (memory and processing) in network devices. Network devices are clustered based on features extracted from the traffic and based on the causality between devices. Detection is performed per cluster. Performance evaluations took as input the CTU-13 Czech Republic University, CAIDA and Botnet 2014 datasets, efficiently detecting the bots in the dataset with an accuracy of 99.9%.

Botnet detection based on DNS traffic similarity

Botnet detection based on DNS traffic similarity

Traffic feature-based botnet detection scheme emphasizing the importance of long patterns

Traffic feature-based botnet detection scheme emphasizing the importance of long patterns

Botnet detection based on DNS traffic similarity

Despite the efforts in combating the threat of botnets, they still grow in size and evasion techniques. The bot software is written once and spreads to other machines all over the world. The bot software is preconfigured to locate the malicious domain name (if it is not static) through the DNS system, like any other legitimate host. In this paper, a scalable approach for detecting a group of bot hosts from their DNS traffic is proposed. The proposed approach leverages a signal processing technique, power spectral density (PSD) analysis, to discover the significant frequencies (i.e., periods) of the botnets periodic DNS queries. The proposed approach processes the timing information of the generated DNS queries, regardless of the number of queries or domain names. Measuring the level of similarity between hosts demonstrating periodic DNS queries should reveal the group of bot hosts in the monitored network. Finally, we evaluated the proposed approach using multiple DNS traces collected from different sources along with a real world botnet deployed under controlled environment. The evaluation result shows that the proposed approach was able to detect the group of bot hosts that demonstrates similar periodic DNS pattern with high accuracy and minimum false positives rates.

Analysis and characterization of IoT malware command and control communication

The emergence of Mirai botnet in 2016 took worldwide research teams by surprise, proving that a large number of low-performance IoT devices could be hacked and used for illegal purposes, causing extremely voluminous DDoS attacks. Therefore, a thorough inspection of the current state of IoT botnets is essential. In this paper, we analyze the dynamic behavior and command and control channels of two classes of IoT botnets, Mirai and Gafgyt. Based on collected information, a comparative analysis and key phases of botnet communication is provided. Such an analysis will serve as a basis for smart botnet detection mechanisms.