Botnet behaviour analysis: How would a data analytics-based system with minimum a priori information perform?

Haddadi, Fariba; Zincir-Heywood, A. Nur

doi:10.1002/nem.1977

Title: Botnet behaviour analysis: How would a data analytics-based system with minimum a priori information perform?

Journal Article · Tue May 09 00:00:00 EDT 2017 · International Journal of Network Management

DOI:https://doi.org/10.1002/nem.1977· OSTI ID:1543482

^[1]; Zincir-Heywood, A. Nur ^[1]

Dalhousie Univ., Halifax, NS (Canada). Faculty of Computer Science

Botnets, as one of the most aggressive threats, has used different techniques, topologies, and communication protocols in different stages of their lifecycle since 2003. Hence, identifying botnets has become very challenging specifically given that they can upgrade their methodology at any time. Various detection approaches have been proposed by the cyber-security researchers, focusing on different aspects of these threats. In this work, 5 different botnet detection approaches are investigated. These systems are selected based on the technique used and type of data used where 2 are public rule–based systems (BotHunter and Snort) and the other 3 use machine learning algorithm with different feature extraction methods (packet payload based and traffic flow based). On the other hand, 4 of these systems are based on a priori knowledge while one is using minimum a priori information. The objective here is to evaluate the effectiveness of these approaches under different scenarios (eg, multi-botnet and single-botnet classifications) as well as exploring how a system with minimum a priori information would perform. The goal is to investigate if a system with minimum a priori information could result in a competitive performance compared to systems using a priori knowledge. The evaluation is shown on 24 publicly available botnet data sets. Results indicate that a machine learning–based system with minimum a priori information not only achieves a very high performance but also generalizes much better than the other systems evaluated on a wide range of botnet structures (from centralized to decentralized botnets).

View Accepted Manuscript (DOE)

Cite

Export

Save

Research Organization:: Lawrence Berkeley National Laboratory (LBNL), Berkeley, CA (United States). National Energy Research Scientific Computing Center (NERSC)

Sponsoring Organization:: USDOE

OSTI ID:: 1543482

Journal Information:: International Journal of Network Management, Vol. 27, Issue 4; ISSN 1055-7148

Country of Publication:: United States

Language:: English

Citation Metrics:

Cited by: 7 works

Citation information provided by
Web of Science

References (12)

A fuzzy pattern-based filtering algorithm for botnet detection Wang, Kuochen; Huang, Chun-Ying; Lin, Shang-Jyh Computer Networks, Vol. 55, Issue 15 https://doi.org/10.1016/j.comnet.2011.05.026	journal	October 2011
An empirical comparison of botnet detection methods García, S.; Grill, M.; Stiborek, J. Computers & Security, Vol. 45 https://doi.org/10.1016/j.cose.2014.05.011	journal	September 2014
Botnet Detection Based on Network Behavior Strayer, W. Timothy; Lapsely, David; Walsh, Robert Botnet Detection https://doi.org/10.1007/978-0-387-68768-1_1	book	January 2008
Machine learning algorithms for accurate flow-based network traffic classification: Evaluation and comparison Soysal, Murat; Schmidt, Ece Guran Performance Evaluation, Vol. 67, Issue 6 https://doi.org/10.1016/j.peva.2010.01.001	journal	June 2010
Benchmarking the Effect of Flow Exporters and Protocol Filters on Botnet Traffic Classification Haddadi, Fariba; Zincir-Heywood, A. Nur IEEE Systems Journal, Vol. 10, Issue 4 https://doi.org/10.1109/JSYST.2014.2364743	journal	December 2016
An Overview of IP Flow-Based Intrusion Detection Sperotto, A.; Schaffrath, G.; Sadre, R. IEEE Communications Surveys & Tutorials, Vol. 12, Issue 3 https://doi.org/10.1109/SURV.2010.032210.00054	journal	January 2010
CoCoSpot: Clustering and recognizing botnet command and control channels using traffic analysis Dietrich, Christian J.; Rossow, Christian; Pohlmann, Norbert Computer Networks, Vol. 57, Issue 2 https://doi.org/10.1016/j.comnet.2012.06.019	journal	February 2013
On the Effectiveness of Different Botnet Detection Approaches Haddadi, Fariba; Le Cong, Duc; Porter, Laura Information Security Practice and Experience https://doi.org/10.1007/978-3-319-17533-1_9	book	January 2015
Clustering botnet communication traffic based on n-gram feature selection Lu, Wei; Rammidi, Goaletsa; Ghorbani, Ali A. Computer Communications, Vol. 34, Issue 3 https://doi.org/10.1016/j.comcom.2010.04.007	journal	March 2011
Botnet detection based on traffic behavior analysis and flow intervals Zhao, David; Traore, Issa; Sayed, Bassam Computers & Security, Vol. 39 https://doi.org/10.1016/j.cose.2013.04.007	journal	November 2013
An Effective Network Traffic Classification Method with Unknown Flow Detection IEEE Transactions on Network and Service Management, Vol. 10, Issue 2 https://doi.org/10.1109/TNSM.2013.022713.120250	journal	June 2013
Coevolutionary bid-based genetic programming for problem decomposition in classification Lichodzijewski, Peter; Heywood, Malcolm I. Genetic Programming and Evolvable Machines, Vol. 9, Issue 4 https://doi.org/10.1007/s10710-008-9067-9	journal	July 2008

Cited By (4)

Botnet detection based on network flow summary and deep learning Pektaş, Abdurrahman; Acarman, Tankut International Journal of Network Management, Vol. 28, Issue 6 https://doi.org/10.1002/nem.2039	journal	July 2018
Deep learning to detect botnet via network flow summaries Pektaş, Abdurrahman; Acarman, Tankut Neural Computing and Applications, Vol. 31, Issue 11 https://doi.org/10.1007/s00521-018-3595-x	journal	July 2018
A novel network virtualization based on data analytics in connected environment Bui, Khac-Hoai Nam; Cho, Sungrae; Jung, Jason J. Journal of Ambient Intelligence and Humanized Computing, Vol. 11, Issue 1 https://doi.org/10.1007/s12652-018-1083-x	journal	October 2018
An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers Khan, Riaz Ullah; Zhang, Xiaosong; Kumar, Rajesh Applied Sciences, Vol. 9, Issue 11 https://doi.org/10.3390/app9112375	journal	June 2019