Parallel botnet detection system by using GPU

Abstract

In recent years, botnet is one of the major threats to network security. Many approaches have been proposed to detect botnets by comparing bot features. Usually, these approaches adopt traffic reduction strategy as first step to reduce the flow to following strategies by filtering packets. With the rapid development of network hardware and software the network speed has reached to multi-gigabit. However, analyzing header and payload of every packet consumes huge amount of computational resources and is not suitable for many realistic situations. Although signaturebased solutions are accurate, it is not possible to detect bot variants in real-time. In this study, we proposed a GPU-based botnet detection approach. The experimental results show that the network traffic reduction stage on GPU can achieve about 8x times over CPU based botnet detection tool. The proposed algorithm can used to improve the performance of botnet detection tools efficiently.

A Survey on Botnets: Incentives, Evolution, Detection and Current Trends

“…A great amount of botnet detection mechanisms, most of which are based on network analysis, will not use real time detection, as the high number of data overwhelm most CPU detection-based systems. Because of this, Che-Lun and Hsiao-Hsi propose the use of GPU based detection over CPU-based detection to gain a speedup in real time detection [137]. By using GPU based detection, packet loss would occur less frequently as the throughput capacity of the detection system increases.…”

An Efficient Detection of Malware by Naive Bayes Classifier Using GPGPU

“…They were able to achieve 22 less memory utilization and 38 times higher bandwidth compared to their single-core implementation. In 2014, Che-Lun Hung et al, proposed a GPU based botnet detection technique [10]. They implemented the network traffic reduction on GPU and were able to achieve eight times performance over CPU based traffic reduction.…”