Noise-resistant mechanisms for the detection of stealthy peer-to-peer botnets

Narang, Pratik; Hota, Chittaranjan; Sencar, Hüsrev Taha

doi:10.1016/j.comcom.2016.05.017

Cited by 10 publications

(13 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…P2P bots form structured P2P topologies (bot‐only) or join an existing P2P network (parasite and leeching) and communicate through custom or well‐known P2P protocols. Consequently, such traffic can easily blend in with legitimate P2P traffic . However, this challenge is considered in a few P2P botnet detection schemes.…”

Section: Related Workmentioning

confidence: 99%

“…Furthermore, the C&C communication also follows certain timing patterns. This periodic behavior is utilized in some botnet detection proposals() as P2P botnet footprint.…”

Section: A Taxonomy Of P2p Botnet Detection Footprintsmentioning

confidence: 99%

“…Narang et al() utilized discrete Fourier transforms (DFT), as formulated in Equation , to uncover the periodicity in the input signals. Given a vector of N input amplitudes, x (0), x (1)... x ( N − 1), the DFT produces a set of N frequency magnitudes.…”

Section: A Taxonomy Of P2p Botnet Detection Footprintsmentioning

confidence: 99%

“…Consequently, such traffic can easily blend in with legitimate P2P traffic. 3 However, this challenge is considered in a few P2P botnet detection schemes. 2,3 Narang et al 3 proposed a P2P botnet detection approach using conversation-based mechanisms and new features based on Fourier transform and information entropy.…”

Section: Related Workmentioning

confidence: 99%

“…3 However, this challenge is considered in a few P2P botnet detection schemes. 2,3 Narang et al 3 proposed a P2P botnet detection approach using conversation-based mechanisms and new features based on Fourier transform and information entropy. They considered the presence of benign P2P traffic and presence of deliberate injection of noise by an adversary as two challenges of detecting P2P bots.…”

Section: Related Workmentioning

confidence: 99%

See 4 more Smart Citations

On the resilience of P2P botnet footprints in the presence of legitimate P2P traffic

Daneshgar

Abbaspour

2019

Int J Communication

View full text Add to dashboard Cite

Summary Botnet is a distributed platform for illegal activities severely threaten the security of the Internet. Fortunately, although their complicated nature, bots leave some footprints during the C&C communication that have been utilized by security researchers to design detection mechanisms. Nevertheless, botnet designers are always trying to evade detection systems by leveraging the legitimate P2P protocol as C&C channel or even mimicking legitimate peer‐to‐peer (P2P) behavior. Consequently, detecting P2P botnet in the presence of normal P2P traffic is one of the most challenging issues in network security. However, the resilience of P2P botnet detection systems in the presence of normal P2P traffic is not investigated in most proposed schemes. In this paper, we focused on the footprint as the most essential part of a detection system and presented a taxonomy of footprints utilized in behavioral P2P botnet detection systems. Then, the resilience of mentioned footprints is analyzed using three evaluation scenarios. Our experimental and analytical investigations indicated that the most P2P botnet footprints are not resilient to the presence of legitimate P2P traffic and there is a pressing need to introduce more resilient footprints.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Furthermore, the C&C communication also follows certain timing patterns. This periodic behavior is utilized in some botnet detection proposals() as P2P botnet footprint.…”

Section: A Taxonomy Of P2p Botnet Detection Footprintsmentioning

confidence: 99%

Section: A Taxonomy Of P2p Botnet Detection Footprintsmentioning

confidence: 99%