On the detection and identification of botnets

Abstract

We develop and discuss automated and self-adaptive systems for detecting and classifying botnets based on machine learning techniques and integration of human expertise. The proposed concept is purely passive and is based on analyzing information collected at three levels: (i) the payload of single packets received, (ii) observed access patterns to the darknet at the level of network traffic, and (iii) observed contents of TCP/IP traffic at the protocol level.We illustrate experiments based on real-life data collected with a darknet set up for this purpose to show the potential of the proposed concept for (i) and (ii). In (iii) we use a small spamtrap as darknets cannot capture TCP/IP traffic data, so this experiment is not a purely passive approach, but traffic moving through a network could be analyzed in a similar way to obtain a purely passive system for this step as well.

BotNet Detection: Enhancing Analysis by Using Data Mining Techniques

“…While the solutions in (Valeur, Vigna, Kruegel, & Kemmerer, 2004) have been initial honeynet-based solutions, many papers discussed detecting and tracking botnets for different honeynet configurations. The second approach, based on passive network monitoring and analysis, can be classified as signature-based, DNS-based, anomaly-based and mining-based (Feily et al, 2009;Seewald & Gangsterer, 2010). These two approaches and sub classifications are detailed below.…”

“…According to the US FBI and public trackers, at least a million bots are known to exist like ShadowServer and the true number is likely to be much higher. The number of bots is also still growing at an exponential rate (Seewald & Gangsterer, 2010).…”

“…According to the report a large volume of malicious activities from distributeddenial-of-service (DDoS) attacks to spamming, phishing, identity theft and DNS server spoofing can be realized by using the distributed power of botnets (W. Lu, Rammidi, & Ghorbani, 2011). Also one of the largest spam filter companies, SpamHaus,2 has estimated that already in 2004, 70% of spam was sent out via such networks (NISCC, 2005) (Seewald & Gangsterer, 2010). According to the US FBI and public trackers, at least a million bots are known to exist like ShadowServer and the true number is likely to be much higher.…”

Stopping spam with sending session verification

“…A vast majority of spams today spread out from networks comprised of hijacked computers that are called bots or zombies and are controlled by spam operators [11,12]. Another widespread method that spammers use to hide their identities is to use open proxies [13].…”

Network Forensics: Detection and Mitigation of Botnet Malicious Code via Darknet

“…Botnet is a collection of software robots, or in short termed 'bots', that run autonomously and automatically. The term botnet [3,4] can also be used to refer to any group of bots, such as IRC bots (Internet Relay Chat bots). In general, botnet refers to a collection of compromised computers, or Zombie computers that receive instructions from command and control (C&C) servers.…”