Botnet detection based on traffic behavior analysis and flow intervals

Zhao, David; Traoré, Issa; Sayed, Bassam; Lu, Wei; Saad, Sherif; Ghorbani, Ali A.; Garant, Dan

doi:10.1016/j.cose.2013.04.007

Cited by 289 publications

(190 citation statements)

References 3 publications

Supporting

Mentioning

182

Contrasting

Unclassified

Order By: Relevance

“…In [103], authors propose an approach to detect botnet activities through traffic behavior analysis. They classify traffic behavior using machine learning strategy.…”

Section: Basis Of Defense Methodsmentioning

confidence: 99%

See 1 more Smart Citation

A Survey on DDoS Attack and Defense Strategies: From Traditional Schemes to Current Techniques

Aamir

Zaidi

2013

IIS

View full text Add to dashboard Cite

Distributed Denial of Service (DDoS) attacks exhaust victim's bandwidth or services. Traditional architecture of Internet is vulnerable to DDoS attacks and an ongoing cycle of attack & defense is observed. A recent attack report of year 2013 -'Quarter 1' from Prolexic Technologies identifies that 1.75 percent increase in total number of DDoS attacks has been recorded as compared to similar attacks of previous year's last quarter. In this paper, different types and techniques of DDoS attacks and their countermeasures are surveyed. The significance of this paper is the coverage of many aspects of countering DDoS attacks including new research on the topic. We survey different papers describing methods of defense against DDoS attacks based on entropy variations, traffic anomaly parameters, neural networks, device level defense, botnet flux identifications, application layer DDoS defense and countermeasures in wireless networks, CCN & cloud computing environments. We also discuss some traditional methods of defense such as traceback and packet filtering techniques, so that readers can identify major differences between traditional and current techniques of defense against DDoS attacks. We identify that application layer DDoS attacks possess the ability to produce greater impact on the victim as they are driven by legitimate-like traffic, making it quite difficult to identify and distinguish from legitimate requests. The need of improved defense against such attacks is therefore more demanding in research. The study conducted in this paper can be helpful for readers and researchers to recognize better techniques of defense in current times against DDoS attacks and contribute with more research on this topic in the light of future challenges identified in this paper.

show abstract

“…In [103], authors propose an approach to detect botnet activities through traffic behavior analysis. They classify traffic behavior using machine learning strategy.…”

Section: Basis Of Defense Methodsmentioning

confidence: 99%

“…Traffic Behavior Analysis [103] Detecting botnet activities by classifying the traffic behavior using machine learning strategy.…”

Section: Defense Against Ddos Attacks In Wsns and Manetsmentioning

confidence: 99%

A Survey on DDoS Attack and Defense Strategies: From Traditional Schemes to Current Techniques

Aamir

Zaidi

2013

IIS

View full text Add to dashboard Cite

show abstract

“…The suggested structure spots and interprets IRC movement within unprocessed network traffic and, by examining a group of expressive factors, enables an organizer to group and segregate regular activity occurrences from botnet-associated ones. In [12] suggests a novel methodology to spot botnet movement relying on traffic performance investigation by grouping network traffic manners applying machine learning techniques. Traffic activities investigation techniques do not rely upon the packets consignment, which signifies that they can operate with encrypted network interaction protocols.…”

Section: Related Workmentioning

confidence: 99%

A Framework on botnet detection and forensics

Singh¹,

Bijalwan²

2017

Proceedings of the Second International Conference on Research in Intelligent and Computing in Engineering

View full text Add to dashboard Cite

Abstract-The utilization of Internet on domestic and corporate front has been increasing at drastic rate. Each organization and enterprise exploits the internet to its fullest extent based on its requirements. In almost all areas, internet is proved to be a boon. But sometimes it lands the users into trouble because of unwanted and uninvited harmful software applications. There are so many types of threats and challenges that are faced by the internet users. Out of all the threats faced by internet users, botnets are at the top most position. Because of these prodigious threats botnets are the rising area of research. Botnet works as a coordinated or synchronized activity where different bots collectively participate to perform a malicious task. The botnet is different from other form of malware in its capability to compromise the computer systems or smartphones to set up a link with command and control(C&C) server controlled by bot controller. Because of the massive participation of compromised machines the losses caused by botnet attack are immeasurable. As a result, different researchers are showing keen interest in the field of botnets. The trend reflects that the number of researches in this field have gone up at tremendous rate in past 5 to 10 years. The present paper proposes a framework to systematically identify the presence of malicious bot, prevent it from spreading further and performing its forensic investigation.

show abstract

“…Network-based detection [18] techniques are based on the analysis of network flow to detect infected machines. Network traffic can be analyzed at the packet and network flow level.…”

Section: Network-based Detectionmentioning

confidence: 99%