A Detection Method for Botnet Based on Behavior Features

Abstract:

How to detect Botnet has become a very important problem in security network. The existent detection methods based on network traffic and host behaviors cant handle the emergency Botnets. In this paper we present an optimized method to analyze the similarity and time period of Botnets behaviors. In the end, our method gets an effective result. Our method uses the IDS-like architecture, which develops six specific components to detect six important Botnets abnormal behaviors. And it builds correlation rules to calculate match score. Through the experiments described in the paper, we can see that our method can not only detect already known Botnets precisely, but also detect unknown Botnets to some extent. The experiments prove that our method is effective and it has some advantages compared with other methods. At last, the paper proposes the future direction and the points that need to be improved.

• Periodical: Advanced Materials Research (Volumes 765-767)
• Pages: 1512-1517
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.765-767.1512
• Online since: September 2013
• Authors: Wei Ming Li, Song Lin Xie, Jie Luo, Xiao Dong Zhu
• Keywords: Behaviors Feature, Botnet, Network Security, Similarity

References

[1] T. Strayer, D. Lapsley, R. Walsh, and C. Livadas, Botnet detection based on network behavior, Botnet Detection: Countering the Largest Security Threat, in Series: Advances in Information Security, Vol. 36, W. K. Lee, C. Wang, D. Dagon, (Eds. ), Springer, 2008, pp.1-24.

DOI: 10.1007/978-0-387-68768-1_1

[2] C. Livadas, R. Walsh, D. Lapsley, T. Strayer, Using machine learning techniques to identify botnet traffic, in Proceedings 2006 31st IEEE Conference on Local Computer Networks, 2006, pp.967-974.

DOI: 10.1109/lcn.2006.322210

[3] J.R. Binkley and S. Singh, An algorithm for anomaly-based botnet detection, USENIX SRUTI: 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet, 2006, pp.43-48.

[4] A. Karasaridis, B. Rexroad, and D. Hoeflin, Wide-scale botnet detection and characterization, in Proceedings of the 1st Conference on 1st Workshop on Hot Topics in Understanding Botnets, Cambridge, MA, (2007).

[5] G. Gu, P. Porras, V. Yegneswaran, M. Fong, W. Lee. Bothunter: Detecting malware infection through ids-driven dialog correlation, in 16th USENIX Security Symposium, (2007).

[6] G.F. Gu, J.J. Zhang, and W.K. Lee, BotSniffer: detecting botnet command and control channels in network traffic, in Proceedings of the 15th Annual Network and Distributed System Security Symposium, San Diego, CA, (2008).

[7] G.F. Gu, R. Perdisci, J.J. Zhang, and W.K. Lee. BotMiner: clustering analysis of network traffic for protocol- and structure-independent Botnet detection, in Proceedings of the 17th USENIX Security Symposium, San Jose, CA, (2008).

[8] H. Choi, H. Lee, H. Lee, and H. Kim, Botnet detection by monitoring group activities in DNS traffic, in Proceedings of the 7th IEEE International Conference on Computer and Information Technology, Washington D.C., USA, 2007, pp.715-720.

DOI: 10.1109/cit.2007.90

[9] The Honeynet Project. Know Your Enemy: Fast-Flux Service Networks, (2007).

[10] T. Holz, C. Gorecki, K. Rieck, and F. C. Freiling. Measuring and detecting fast-flux service networks. In Proc. network and Distributed System Security Symposium, (2008).

[11] Information on http: /www. clamav. net/lang/en.