Fast flux botnet detection framework using adaptive dynamic evolving spiking neural network algorithm

Al-Nawasrah, Ahmad; Almomani, Ammar; Meziane, Farid; Alauthman, Mohammad

doi:10.1109/iacs.2018.8355433

Cited by 10 publications

(5 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Real-time approaches detect fast flux domain near real-time but suffer memory and accuracy. We are still lacking the presence of a stable method which can detect malicious domains during an acceptable amount of time with showing a high level of accuracy in terms of detection (Al-Nawasrah et al, 2018).…”

Section: Detection Methods That Are Host-basedmentioning

confidence: 99%

Botnet detection used fast-flux technique, based on adaptive dynamic evolving spiking neural network algorithm

Almomani

Nawasrah

Meziane

et al. 2021

IJAHUC

Self Cite

View full text Add to dashboard Cite

A botnet refers to a group of machines. These machines are controlled distantly by a specific attacker. It represents a threat facing the web and data security. Fast-flux service network (FFSN) has been engaged by bot herders for cover malicious botnet activities. It has been engaged by bot herders for increasing the lifetime of malicious servers through changing the IP addresses of the domain name quickly. In the present research, we aimed to propose a new system. This system is named fast flux botnet catcher system (FFBCS). This system can detect FF-domains in an online mode using an adaptive dynamic evolving spiking neural network algorithm. Comparing with two other related approaches the proposed system shows a high level of detection accuracy, low false positive and negative rates, respectively. It shows a high performance. The algorithm's proposed adaptation increased the accuracy of the detection. For instance, this accuracy reached (98.76%) approximately.

show abstract

Section: Detection Methods That Are Host-basedmentioning

confidence: 99%

Botnet detection used fast-flux technique, based on adaptive dynamic evolving spiking neural network algorithm

Almomani

Nawasrah

Meziane

et al. 2021

IJAHUC

Self Cite

View full text Add to dashboard Cite

show abstract

“…A fast-flux detection method was proposed by (Al-Nawasrah et al, 2018), authors build an approachthatdetectsfast-fluxdomainsinreal-timemode.Theirapproachwasbasedontheadaptive dynamicevolvingspikingneuralnetworkalgorithm.Thedetectionaccuracywasabove98%,but thereweretoomanyparametersneededtobesetbeforerunningthealgorithm.…”

Section: Real-time Approachesmentioning

confidence: 99%

A Survey of Fast Flux Botnet Detection With Fast Flux Cloud Computing

Al-Nawasrah

Almomani

Atawneh

et al. 2020

International Journal of Cloud Applications and Computing

Self Cite

View full text Add to dashboard Cite

A botnet refers to a set of compromised machines controlled distantly by an attacker. Botnets are considered the basis of numerous security threats around the world. Command and control (C&C) servers are the backbone of botnet communications, in which bots send a report to the botmaster, and the latter sends attack orders to those bots. Botnets are also categorized according to their C&C protocols, such as internet relay chat (IRC) and peer-to-peer (P2P) botnets. A domain name system (DNS) method known as fast-flux is used by bot herders to cover malicious botnet activities and increase the lifetime of malicious servers by quickly changing the IP addresses of the domain names over time. Several methods have been suggested to detect fast-flux domains. However, these methods achieve low detection accuracy, especially for zero-day domains. They also entail a significantly long detection time and consume high memory storage. In this survey, we present an overview of the various techniques used to detect fast-flux domains according to solution scopes, namely, host-based, router-based, DNS-based, and cloud computing techniques. This survey provides an understanding of the problem, its current solution space, and the future research directions expected.

show abstract

“…In [34], the authors proposed an approach to detect malicious domains by analyzing a massive mobile web traffic data. In [35], the authors proposed a semi supervised ML model using a neural network to identify anomalies in network traffic. The goal was to detect potential attacks hidden by fast flux.…”

Section: ) Knowledge-based and Machine Learning-based Approachesmentioning

confidence: 99%

ARBA: Anomaly and Reputation Based Approach for Detecting Infected IoT Devices

et al. 2020

View full text Add to dashboard Cite

Today, cyber attacks are constantly evolving and changing, which makes them harder to detect. In particular, detecting attacks in large-scale networks is very challenging because they require high detection rates under real-time resource constraints. In this paper, we focus on detecting infected Internet of Things (IoT) hosts from domain name system (DNS) traffic data. IoT hosts, such as streaming cameras, printers, air conditioners, are hard to protect, unlike PCs and servers. Enterprises are often unaware of the devices which are connected to the network, their types, makes, and vulnerabilities. Since IoT hosts make use of the DNS protocol, analyzing DNS data can give a broad view of malicious activities, because they abuse the DNS protocol and leave fingerprints as part of their attack vector. In this collaborative research between Ben-Gurion University, and IBM, we establish a novel algorithm to detect infected IoT hosts in large-scale DNS traffic, named Anomaly and Reputation Based Algorithm (ARBA). Its novelty resides in developing a framework that combines host classification and domain reputation in a real-time production environment. ARBA is highly computational efficient and meets real-time requirements in terms of run time and computational complexity. By contrast to existing algorithms, it does not require a massive traffic volume for training, which is of significant interest in detecting infected hosts in real-time. The research was conducted on real live streaming data from IBM internal network traffic, and confirm the algorithm's strong performance in a real-time production environment. INDEX TERMS Cyber security, anomaly detection, domain name system (DNS), detection algorithms, real-time algorithms.

show abstract

Fast flux botnet detection framework using adaptive dynamic evolving spiking neural network algorithm

Cited by 10 publications

References 13 publications

Botnet detection used fast-flux technique, based on adaptive dynamic evolving spiking neural network algorithm

Botnet detection used fast-flux technique, based on adaptive dynamic evolving spiking neural network algorithm

A Survey of Fast Flux Botnet Detection With Fast Flux Cloud Computing

ARBA: Anomaly and Reputation Based Approach for Detecting Infected IoT Devices

Contact Info

Product

Resources

About