Research on New Botnet Detection Strategy Based on Information Materials

Abstract:

Recognized as one the most serious security threats on current Internet infrastructure, botnets with its low resource requirements have developed rapidly. How to detect botnets has become a major topic of current research. Based on existing research results, this paper proposes a new detection strategy, which solves unknown botnet detection efficiency by the behavioral characteristics of botnets. The core idea is separating static characteristic and dynamic behavior of botnet, and optimizing dynamic the parameters of dynamic behavior, and changing passive defense into active defense. According to the behavior of the attacker, this strategy can optimize behavior parameters. The proposed approach has the commonality and the expansibility, which strengthen unknown botnet defense fundamentally.

• Periodical: Advanced Materials Research (Volumes 282-283)
• Pages: 236-239
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.282-283.236
• Online since: July 2011
• Authors: Chun Yong Yin, Ali A. Ghorbani, Ru Xia Sun
• Keywords: Botnet, Data Mining (DM), Detection, Dynamic Behavior, Static Characteristic

References

[1] McCarty, B., Botnets: big and bigger. Security & Privacy, IEEE, 2003. 1(4): pp.87-90.

DOI: 10.1109/msecp.2003.1219079

[2] Li, Z., et al., Towards Situational Awareness of Large-scale Botnet Probing Events. Information Forensics and Security, IEEE Transactions on, 2010. PP(99): pp.1-1.

DOI: 10.1109/tifs.2010.2086445

[3] Schaffer, G.P., Worms and viruses and botnets, oh my! Rational responses to emerging Internet threats. Security & Privacy, IEEE, 2006. 4(3): pp.52-58.

DOI: 10.1109/msp.2006.83

[4] Liu, S., Surviving Distributed Denial-of-Service Attacks. IT Professional, 2009. 11(5): pp.51-53.

[5] MyungKeun, Y., Using whitelisting to mitigate DDoS attacks on critical Internet sites. Communications Magazine, IEEE, 2010. 48(7): pp.110-115.

DOI: 10.1109/mcom.2010.5496886

[6] Ping, W., S. Sparks, and C.C. Zou, An Advanced Hybrid Peer-to-Peer Botnet. Dependable and Secure Computing, IEEE Transactions on, 2010. 7(2): pp.113-127.

DOI: 10.1109/tdsc.2008.35

[7] LI Rui, et al., Study on the Self-Similarity of P2P Traffic Behavior Based on Fractal Method. Journal of Beijing University of Posts and Telecommunications, 2010. 33(4): pp.35-38.

[8] YU Ge, et al., Rapid Detection Technique for P2P-Based Botnets. Journal of Northeastern University( Natural Science), 2010. 31(12): pp.1709-1712.

[9] Stone-Gross, B., et al., Analysis of a Botnet Takeover. Security & Privacy, IEEE, 2010. PP(99): pp.1-1.

[10] Baecher P, Koetter M, Holz T, et al. The Nepenthes platform: An efficient approach to collect malware [G]/LNCS 4219: Proc of the Int Symp on Recent Advances in Intrusion Detection (RAID 06 ). Berlin: Springer, 2006: 165-184.

DOI: 10.1007/11856214_9

[11] Cheng Jieren, Yin Jianping, Liu Yun, et al. Advances in the honeypot and honeynet technologies. Journal of Computer Research and Development, 2008, 45 (Suppl): 375-378 (in Chinese).

[12] Zhu Zhaosheng, Fu Zhi Judy, Lu Guohan, et al. Botnet research survey [C]/Proc of the 32nd Int Computer Software and Applications Conference. Washington, DC: IEEE Computer Society, 2008: 967-972.

DOI: 10.1109/compsac.2008.205

[13] Govil J, Govil J. Criminology of botnets and their detection and defense methods [C]/Proc of 2007 IEEE Int Conf on Electro/Information Technology ( EIT2007 ). Washington, DC: IEEE Computer Society, 2007: 215-220.

DOI: 10.1109/eit.2007.4374517