A Novel Approach for the Early Detection and Identification of Botnets

Abstract:

Botnets are growing in size, number and impact. It continues to be one of the top three web threats that mankind has ever known. The botnets are the souped-up cyber engines driving nearly all criminal commerce on the Internet and are seen as relaying millions of pieces of junk e-mail, or spam. Thus, the need of the hour is the early detection and identification of the heart of network packet flooding or the C&C centre. Most of the botmasters perform DDos attacks on a target server by spoofing the source IP address. The existing botnet detection techniques rely on machine learning algorithms and do not expound the IP spoofing issue. These approaches are also found to be unsuccessful in the meticulous identification of the botmasters. Here we propose an architecture that depend on the PSO-based IP tracebacking. Our architecture also introduces the IP spoofing detector unit so as to ensure that the Traceback moves in the right direction. The approach also detects the zombies and utilizes the PSO optimization technique that aid in the identification of the C&C node. The experimental results show that our approach is successful in prompt detection of the bots.

• Periodical: Advanced Materials Research (Volumes 403-408)
• Pages: 4469-4475
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.403-408.4469
• Online since: November 2011
• Authors: S. Benson Edwin Raj, V.S. Jayanthi, R. Shalini
• Keywords: Botnet, IP Spoofing, Particle Swarm Optimization Algorithm (PSO), Trace Back Technique

References

[1] Alexander K. Seewald and Wilfried N. Gansterer," On the detection and identification of botnets", Science Direct, Computers and Security,pp.45-58, July 2009.

[2] Yuanyuan Zeng, Xin Hu and Kang G. Shin, "Detection of Botnets Using Combined Host- and Network-Level Information", 16th ACM Conference on Computer and Communications Security, 2009.

DOI: 10.1109/dsn.2010.5544306

[3] Ricardo Villamarín-Salomón and José Carlos Brustoloni, "Bayesian Bot Detection Based on DNS Traffic Similarity", Proceedings of ACM Symposium on Applied Computing, 2009.

DOI: 10.1145/1529282.1529734

[4] Anestis Karasaridis, Brian Rexroad, David Hoeflin," Wide-scale Botnet Detection and Characterization", First Workshop on Hot Topics in Understanding Botnets, 2007.

[5] Ping Wang Sherri Sparks Cliff C. Zou, "An Advanced Hybrid Peer-to-Peer Botnet," IEEE Transactions on Dependable and Secure Computing, vol. 7, issue 2, pp.113-127, Jun 2010.

DOI: 10.1109/tdsc.2008.35

[6] Xin Hu, Matthew Knysz, and Kang G. Shin, "RB-Seeker: Auto-detection of Redirection Botnets," 16th Annual Network & Distributed System Security Symposium, Feb 2009.

[7] Michael Bailey, Evan Cooke, Farnam Jahanian, Yunjing Xu and Manish Karir, "A Survey of Botnet Technology and Defenses," ACM Proceedings of Cybersecurity Applications & Technology Conference for Homeland Security, 2009.

DOI: 10.1109/catch.2009.40

[8] W. Timothy Strayer, Robert Walsh, Carl Livadas, and David Lapsley, "Detecting Botnets with Tight Command and Control", 31st IEEE Conference on Local Computer Networks Proceedings, 2006.

DOI: 10.1109/lcn.2006.322100

[9] Kim-Kwang and Raymond Choo, "Zombies and botnets", Trends & Issues in crime and criminal justice in Australian Institute of Criminology , Mar 2007.

[10] N. Goranin and A. Cenys, "Genetic algorithm based Internet worm propagation strategy modeling under pressure of countermeasures", Journal of Engineering Science and Technology Review 2, pp.43-47, 2009.

[11] Ji-Xiang Du, De-Shuang Huang and Zeng-Fu Wang, "Pattern classification with a PSO optimization based elliptical basis function neural networks", IEEE Congress on Evolutionary Computation pp.1654-1661, Sep 2007.

DOI: 10.1109/cec.2007.4424672

[12] J. Kennedy and R. Eberhart, "Particle swarm optimization", Proceedings of IEEE International Conference on Neural Networks, pp.1942-1948, 1995.

[13] http://whatismyipaddress.com/blacklist-check.

[14] Steven J. Templeton and Karl E. Levitt, "Detecting Spoofed Packets", IEEE Proceedings DARPA Information Survivability Conference and Exposition, 2003.

DOI: 10.1109/discex.2003.1194882