Analysis on the time-domain characteristics of botnets control traffic

doi:10.1016/S1005-8885(10)60052-0

中国邮电高校学报(英文) ›› 2011, Vol. 18 ›› Issue (2): 106-113.doi: 10.1016/S1005-8885(10)60052-0

• Artificial Intelligence • 上一篇下一篇

Analysis on the time-domain characteristics of botnets control traffic

李为民¹,缪晨²,刘芳¹,雷振明³

1. 北京邮电大学
2.
3. 北京邮电大学信息处理与智能技术重点实验室

收稿日期:2010-08-27 修回日期:2011-02-21 出版日期:2011-04-30 发布日期:2011-04-15
通讯作者: 李为民 E-mail: lwm_bupt@163.com
基金资助:
国家科技支撑项目 “可信互联网”

Analysis on the time-domain characteristics of botnets control traffic

Received:2010-08-27 Revised:2011-02-21 Online:2011-04-30 Published:2011-04-15

摘要/Abstract

摘要：

Botnets are networks composed with malware-infect ed computers. They are designed and organized to be controlled by an adversary. As victims are infected through their inappropriate network behaviors in most cases, the Internet protocol (IP) addresses of infected bots are unpredictable. Plus, a bot can get an IP address through dynamic host configuration protocol (DHCP), so they need to get in touch with the controller initiatively and they should attempt continuously because a controller can’t be always online. The whole process is carried out under the command and control (C&C) channel. Our goal is to characterize the network traffic under the C&C channel on the time domain. Our analysis draws upon massive data obtained from honeynet and a large Internet service provider (ISP) Network. We extract and summarize fingerprints of the bots collected in our honeynet. Next, with the fingerprints, we use deep packet inspection (DPI) Technology to search active bots and controllers in the Internet. Then, we gather and analyze flow records reported from network traffic monitoring equipments. In this paper, we propose a flow record interval analysis on the time domain characteristics of botnets control traffic, and we propose the algorithm to identify the communications in the C&C channel based on our analysis. After that, we evaluate our approach with a 3.4 GB flow record trace and the result is satisfactory. In addition, we believe that our work is also useful information in the design of botnet detection schemes with the deep flow inspection (DFI) technology.

关键词:

botnet detection, netflow record, time domain analysis, deep flow inspection

Abstract:

Key words:

botnet detection, netflow record, time domain analysis, deep flow inspection

参考文献

1. Chiang K, Lloyd L. A case study of the Rustock rootkit and spam bot. Proceedings of the 1st Workshop on Hot Topics in Understanding Botnets (HotBots’07), Apr 10-11, 2007, Cambridge, MA, USA. Berkeley, CA, USA: USENIX Association, 2007

2. Cooke E, Jahanian F, McPherson D. The zombie roundup: Understanding, detecting, and disturbing botnets. Proceedings of the 1st Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI’05), Jul 7-8, 2005, Cambridge, MA, USA. Berkeley, CA, USA: USENIX Association, 2005: 39-44

3. Xie Y L, Yu F, Achan K,et al. Spamming botnets: Signatures and characteristics. Proceedings of the Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM’08), Aug 17-22, 2008, Seattle, WA, USA. New York, NY, USA: ACM, 2008: 171-182

4. Villamarin-Salomon R, Brustoloni J C. Bayesian bot detection based on DNS traffic similarity. Proceedings of the 2009 ACM Symposium on Applied Computing (SAC’09), Mar 8-12, 2009, Honolulu, HI, USA. New York, NY, USA: ACM, 2009: 2035-2041

5. Lu W, Tavallaee M, Ghorbani A A. Automatic discovery of botnet communities on large-scale communication networks. Proceedings of the 4th ACM Symposium on Information, Computer and Communications Security (ASIACCS’09), Mar 10-12, 2009, Sydney, Australia. New York, NY, USA: ACM, 2009: 1-10

6. Karasaridis A, Rexroad B, Hoeflin D. Wide-scale botnet detection and characterization. Proceedings of the 1st Workshop on Hot Topics in Understanding Botnets (HotBots’07), Apr 10-11, 2007, Cambridge, MA, USA. Berkeley, CA, USA: USENIX Association, 2007

7. Cheng Fang, Wang Peng. Development of modern network testing. Journal of Chongqing University of Posts and Telecommunications: Natural Science Edition: 2008, 20(Sup): 57-60 (in Chinese)

8. AsSadhan B, Moura J M F, Lapsley D, et al. Detecting botnets using command and control traffic. Proceedings of the 8th IEEE International Symposium on Network Computing and Applications (NCA’09), Jul 9-11, 2009, Cambridge, MA, USA. Los Alamitos, CA, USA: IEEE Computer Society, 2009: 156-162

9. Stone-Gross B, Cova B, Cavallaro L, et al. Your botnet is, my botnet: Analysis of a botnet takeover. Proceedings of the 16th ACM Conference on Computer and Communications Security (CCS’09), Nov 9-13, 2009, Chicago, IL, USA. New York, NY, USA: ACM, 2009

10. Wei C, Sprague A, Warner G. Detection of networks blocks used by the storm worm botnet. Proceedings of the ACM Southeast Regional Conference (ACM-SE’08), Mar 28-29, 2008, Auburn, AL, USA. New York, NY, USA: ACM, 2008: 356-360

11. Li Z C, Goyal A, Chen Y, et al. Automating analysis of large-scale botnet probing events. Proceedings of the 4th ACM Symposium on Information, Computer and Communications Security (ASIACCS’09), Mar 10-12, 2009, Sydney, Australia. New York, NY, USA: ACM, 2009:11-22

12. De Roo R D. A simplified calculation of the kurtosis for RFI detection. Proceedings of the IEEE International Geoscience and Remote Sensing Symposium (IGARSS’08), Jul 6-11, 2008, Boston, MA, USA. Piscatawaw, NJ, USA: IEEE, 2008

13. Zandy V C, Miller B P. Reliable network connections. Proceedings of the 8th Annual International Conference on Mobile Computing and Networking (MOBICOM’02), Sep 23-26, Atlanta, GA, USA. New York, NY, USA: ACM, 2002: 95-106

Analysis on the time-domain characteristics of botnets control traffic

Analysis on the time-domain characteristics of botnets control traffic

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 0

编辑推荐

Metrics

本文评价