Abstract:

Botnets are networks composed with malware-infect ed computers. They are designed and organized to be controlled by an adversary. As victims are infected through their inappropriate network behaviors in most cases, the Internet protocol (IP) addresses of infected bots are unpredictable. Plus, a bot can get an IP address through dynamic host configuration protocol (DHCP), so they need to get in touch with the controller initiatively and they should attempt continuously because a controller can’t be always online. The whole process is carried out under the command and control (C&C) channel. Our goal is to characterize the network traffic under the C&C channel on the time domain. Our analysis draws upon massive data obtained from honeynet and a large Internet service provider (ISP) Network. We extract and summarize fingerprints of the bots collected in our honeynet. Next, with the fingerprints, we use deep packet inspection (DPI) Technology to search active bots and controllers in the Internet. Then, we gather and analyze flow records reported from network traffic monitoring equipments. In this paper, we propose a flow record interval analysis on the time domain characteristics of botnets control traffic, and we propose the algorithm to identify the communications in the C&C channel based on our analysis. After that, we evaluate our approach with a 3.4 GB flow record trace and the result is satisfactory. In addition, we believe that our work is also useful information in the design of botnet detection schemes with the deep flow inspection (DFI) technology.

Key words:

botnet detection, netflow record, time domain analysis, deep flow inspection