P2P Traffic Identification Algorithm Based on Topology

Abstract:

The botnet consists of some computers controlled by an attacker and has become a major threat to the internet and users. Because the p2p botnet is a distributed network, making the identification of p2p bots is very difficult. In response to this threat, we present a p2p identification algorithm based on topology. This method only depends on three network behavior features. Our approach has a high detection rate and an acceptable low false alarm rate.

• Periodical: Advanced Materials Research (Volume 487)
• Pages: 297-300
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.487.297
• Online since: March 2012
• Authors: Ru Xia Sun, Chun Yong Yin
• Keywords: Algorithm (GA), Identification, Network, P2P Bot, Topology

References

[1] C. Mazzariello: IRC traffic analysis for botnet detection. In: 2008 Fourth International Conference on Information Assurance and Security (IAS), pp.318-323. IEEE, USA (2008).

DOI: 10.1109/ias.2008.58

[2] B. McCarty: Botnets: Big and bigger. Security & Privacy, IEEE, 1 (2003) 87-90.

DOI: 10.1109/msecp.2003.1219079

[3] Information on http: /www. utdallas. edu.

[4] G. P. Schaffer: Worms and viruses and botnets, oh my! Rational responses to emerging Internet threats. Security & Privacy, IEEE, 4 (2006) 52-58.

DOI: 10.1109/msp.2006.83

[5] Binkley, J. R. and S. Singh: An algorithm for anomaly-based botnet detection. In: 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet, pp.43-38, USENIX Association, USA (2006).

[6] C. Y. Yin, et al., Research on New Botnet Detection Strategy Based on Information Materials, Advanced Materials Research. 282 (2011) 236-239.

DOI: 10.4028/www.scientific.net/amr.282-283.236

[7] C. Hyunsang, et al.: Botnet detection by monitoring group activities in DNS traffic. In: 7th IEEE International Conference on Computer and Information Technology, pp.715-720. IEEE Computer Society, USA (2007).

DOI: 10.1109/cit.2007.90

[8] S. Heron, Working the botnet: how dynamic DNS is revitalising the zombie army, Network Security. (2007) 9-11.

DOI: 10.1016/s1353-4858(07)70005-3

[9] Lu, W., G. Rammidi, and A.A. Ghorbani, Clustering botnet communication traffic based on n-gram feature selection, Computer Communications. 34 (2011) 502-514.

DOI: 10.1016/j.comcom.2010.04.007

[10] W. Lu, et al.: Botcop: An online botnet traffic classifier. In: 7th Annual Communication Networks and Services Research Conference, pp.70-77. Inst. of Elec. and Elec. Eng. Computer Society, Canada (2009).

DOI: 10.1109/cnsr.2009.21

[11] L. P. Song, et al., Modeling and analyzing of botnet interactions, Physica A: Statistical Mechanics and its Applications. 390 (2011) 347-358.

DOI: 10.1016/j.physa.2010.10.001

[12] H. Tu, et al.: Detecting botnets by analyzing DNS traffic. In: Pacific Asia Workshop on Intelligence and Security Informatics, pp.323-324. Springer, Germany (2007).

DOI: 10.1007/978-3-540-71549-8_40

[13] H. R. Zeidanloo, et al.: Botnet detection based on common network behaviors by utilizing Artificial Immune System(AIS). In: 2nd International Conference on Software Technology and Engineering, pp.21-25. IEEE Computer Society, USA (2010).

DOI: 10.1109/icste.2010.5608967