Botnet C&C Traffic and Flow Lifespans Using Survival Analysis

Abstract

Abstract-This paper addresses the issue of detecting unwanted traffic in data networks, namely the detection of botnet networks. In this paper, we focused on a time behavioral analysis, more specifically said -lifespans of a simulated botnet network traffic, collected and discovered from NetFlow messages, and also of real botnet communication of a malware.As a method we chose survival analysis and for rigorous testing of differences Mantel-Cox test. Lifespans of those referred traffics are discovered and calculated by lifelines using Python language.Based on our research we have figured out a possibility to distinguish the individual lifespans of C&C communications that are identical to each other by using survival projection curves, although it occurred in a different time course.

Botnet detection based on network flow summary and deep learning

“…Oujezsky et al analyzed botnet's behavior to extract lifespans of C&C communication. The dataset includes real world and simulated botnet traffic.…”

Detection of Algorithmically Generated Malicious Domain

“…To achieve this objective, they usually plant some form of a backdoor or create a C&C channel to allow them to re-enter the system at will [26]. C&C activity is initiated when an attacker compromises an end-user device and transforms that device into a bot that listens out for instructions issued by the botmaster [8], [26].…”

Detection of Algorithmically Generated Malicious Domain Using Frequency Analysis

“…Cyber-criminals like to maintain control of devices and hosts they compromise for long term benefits such as financial gain [16]. To achieve this objective, they usually plant some form of a backdoor or create a C&C channel to allow them to re-enter the system at will [26]. C&C activity is initiated when an attacker compromises an end-user device and transforms that device into a bot that listens out for instructions issued by the botmaster [8], [26].…”

“…To achieve this objective, they usually plant some form of a backdoor or create a C&C channel to allow them to re-enter the system at will [26]. C&C activity is initiated when an attacker compromises an end-user device and transforms that device into a bot that listens out for instructions issued by the botmaster [8], [26]. Norton defines a bot as "a type of malware that allows an attacker to take control over an affected computer" [23].…”

“…Although there are several types of C&C communication channels, for example, using of protocols such as Hypertext Transfer Protocol (HTTP), Internet Relay Chat (IRC) and many more [26], traditionally, cyber-criminals tend to rely on a centralised topology to control their victims by hardcoding their IP addresses or domain names in their malware binaries to allow persistent access between a server they control and a compromised device [16], [30]. Often, the cybercriminals include one or more static domains or IP addresses in their source code as observed with the WannaCry ransomware [9], [40].…”