Detection of botnet by analyzing network traffic flow characteristics using open source tools

Abstract

Botnets are emerging as the most serious cyber threat among different forms of malware. Today botnets have been facilitating to launch many cybercriminal activities like DDoS, click fraud, phishing attacks etc. The main purpose of botnet is to perform massive financial threat. Many large organizations, banks and social networks became the target of bot masters. Botnets can also be leased to motivate the cybercriminal activities. Recently several researches and many efforts have been carried out to detect bot, C&C channels and bot masters. Ultimately bot maters also strengthen their activities through sophisticated techniques. Many botnet detection techniques are based on payload analysis. Most of these techniques are inefficient for encrypted C&C channels. In this paper we explore different categories of botnet and propose a detection methodology to classify bot host from the normal host by analyzing traffic flow characteristics based on time intervals instead of payload inspection. Due to that it is possible to detect botnet activity even encrypted C&C channels are used.

A Framework for Detecting Botnet Command and Control Communication over an Encrypted Channel

“…For example, Richer (2017) [40] proposes an approach using Support Vector Machine and got a 100% detection rate; however the false positive rate is more than 15%. The work by Shanti & Seenivasan (2015) [14] also provides very high false positive which is more than 21%. Above all, Warmer (2011) had the highest false positive value of 44.3% by using Naïve Bayes.…”

“…Thus, this indicates that there is still room for improvement in Botnet detection, uniquely encrypted Botnet. Many Botnet detection techniques are based on payload analysis, and these techniques, unfortunately, are inefficient for encrypted C&C channels (Shanti & Seenivasan, 2015) [14]. [15] prove that Botnet detection techniques that rely on payload analysis could be foiled by encryption.…”

“…Furthermore, by implementing a bruteforce-like decryption technique, it leads to the privacy issue. [14] propose a detection methodology to classify bot hosts from the normal host by analyzing traffic flow characteristics based on time intervals www.ijacsa.thesai.org instead of payload inspection. They use the Decision Tree and Naïve Bayes classification.…”

“…Some researchers claim that their general Botnet detection approaches could even detect encrypted Botnet C&C based on the assumption that their approaches did not analyze the payload content, and it was Botnet structure independent. For example,Shin et al (2012) [30],Khan et al (2015) [31], andShanti & Seenivasan (2015) [14] commonly use traffic flow analysis in their works. Consequently, they did not have to inspect the payload.…”

Detecting Bots inside a Host using Network Behavior Analysis

“…They calculated the flow statistics of the obvious attacker targeting a specific port and identify the nuisance attackers based on the similarity of features between hosts sending flow to port P and the samples. K Shanthi et al, [16] proposed a novel method of classify bots from normal hosts through traffic flow analysis based on time intervals. The authors did not include payload inspection.…”