A Network Behavior-Based Botnet Detection Mechanism Using PSO and K-means

Abstract

In today's world, Botnet has become one of the greatest threats to network security. Network attackers, or Botmasters, use Botnet to launch the Distributed Denial of Service (DDoS) to paralyze large-scale websites or steal confidential data from infected computers. They also employ "phishing" attacks to steal sensitive information (such as users' accounts and passwords), send bulk email advertising, and/or conduct click fraud. Even though detection technology has been much improved and some solutions to Internet security have been proposed and improved, the threat of Botnet still exists. Most of the past studies dealing with this issue used either packet contents or traffic flow characteristics to identify the invasion of Botnet. However, there still exist many problems in the areas of packet encryption and data privacy, simply because Botnet can easily change the packet contents and flow characteristics to circumvent the Intrusion Detection System (IDS). This study combines Particle Swarm Optimization (PSO) and K-means algorithms to provide a solution to remedy those problems and develop, step by step, a mechanism for Botnet detection. First, three important network behaviors are identified: long active communication behavior (ActBehavior), connection failure behavior (FailBehavior), and network scanning behavior (ScanBehavior). These behaviors are defined according to the relevant prior studies and used to analyze the communication activities among the infected computers. Second, the features of network behaviors are extracted from the flow traces in the network layer and transport layer of the network equipment. Third, PSO and K-means techniques are used to uncover the host members of Botnet in the organizational network. This study mainly utilizes the flow traces of a campus network as an experiment. The experimental findings show that this proposed approach can be employed to detect the suspicious Botnet members earlier than the detection application systems. In addition, this proposed approach is easy to implement and can be further used and extended in the campus dormitory network, home networks, and the mobile 3G network. . 2015. A network behavior-based botnet detection mechanism using PSO and K-means.

BotGM: Unsupervised graph mining to detect botnets in traffic flows

“…Unlike our method which relies on modeling dependencies among flows, statistical analysis or machine learning algorithms have been mainly applied on features available in flow records or aggregated properties over a set of flows (duration, number of packets, number of flow records towards each destination, etc.). For example, in [5], the authors combined Particle Swarm Optimization (PSO) and K-means algorithms for botnet detection. In [11], the authors classified network traffic properties based on time intervals using a decision tree classifier.…”

A review of detection approaches for distributed denial of service attacks

“…It also depicts the need of defense mechanisms against such attacks. DDoS attacks are not new offenses against web applications (Li, Kao, Zhang, Chuang, & Yen, 2015). Initially, DDoS attacks were launched in August, 1999 against different organizations and continued attacking the various websites like Yahoo, Amazon, Buy.com, CNN and eBay since then (Bhuyan, Kashyap, Bhattacharyya, & Kalita, 2014;Buragohain, Kalita, Singh, & Bhattacharyya, 2015).…”

“…In 2009, a DDoS attack was launched that disrupted the network services of most popular websites like Live Journal, Facebook, Amazon, and Twitter (Acohido & Swartz, 2009). In 2010 and 2011, more than 75,000 computer systems in 2500 organizations and 4 million computers in 100 countries were affected by DDoS attacks respectively (Li et al, 2015). Each day, more than 7000 DDoS attacks are launched by the attackers (Mousavi, 2014).…”

“…But the attacker undoubtedly modifies the packet contents and traffic flow traits, thus the detection system fails. Moreover, it is very difficult to analyze the encrypted packets (Li et al, 2015). IP attributes (IP protocol type, packet-size) based detection techniques adversely affect the performance by increasing the computational complexity and false positive rate.…”

PSO+K-means Algorithm for Anomaly Detection in Big Data

“…This paper presents a new clustering approach for anomaly detection by using the hybridization of k-means and PSO methods. Numerous clustering methods have been proposed to detect anomalies based on hybridization of PSO and k-means algorithms [12,13,14,15,16,17]. Differences between existing 349 clustering algorithms proposed on the basis of PSO are in their objective functions.…”