Real-time bot infection detection system using DNS fingerprinting and machine-learning

Quezada, Vicente; Astudillo-Salinas, Fabian; Tello-Oquendo, Luis; Bernal, Paul

doi:10.1016/j.comnet.2023.109725

Cited by 9 publications

(2 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the previous research, the botnet activity detection models used classification [1,8,18,24], clustering [25][26][27][28], and similarity. Research by [10,16] used the CTU-13 dataset by combining feature selection methods.…”

Section: Related Workmentioning

confidence: 99%

A New Approach of Botnet Activity Detection Models Using Combination of Univariate and ANOVA Feature Selection Techniques

2024

IJIES

View full text Add to dashboard Cite

The number of cases in the cyber era has increased significantly, which are caused by malicious software known as malware. This malicious software penetrates the network, infects several computers, and forms a collection of zombie computer networks commonly known as Botnets. These botnet threats can gravely impact valuable system resources and stored data and cause severe financial losses if not handled appropriately. Several previous studies introduced a botnet detection model using algorithms from machine learning by optimizing the feature selection process and having high detection results. However, feature selection is carried out without determining the role of features in the mandatory and non-mandatory categories. In fact, not all features can be selected because they have an important role and influence detection performance. This paper proposes a detection model by optimizing feature selection techniques. The initial process is to categorize features into mandatory and non-mandatory features. The feature selection process is carried out on non-mandatory features using two approaches: Univariate and ANOVA. Then, the best features from the feature selection results are aggregated with the Mandatory features and processed in a classification model for detecting malware attacks. The aim is to obtain the best features used in the classification model to improve detection performance by measuring accuracy, precision, and recall. The classification model used is a Decision tree and was tested on three different datasets, namely CTU-13, NCC, and NCC-2. The experiment result obtained an accuracy of 99.27% on the CTU-13 dataset, 98.96% on the NCC dataset, and 98.87% on the NCC-2 dataset. The resulting average precision value is 98.68% in the CTU-13 dataset, 98.26% in the NCC dataset, and 97.90% in the NCC-2 dataset. Finally, the resulting average recall value was 99.27% on the CTU-13 dataset, 98.96% on the NCC dataset, and 98.87% on the NCC-2 dataset. The detection results showed better results than previous research. This model can make analyzing attacks easier and determine treatment when a malware attack occurs.

show abstract

Section: Related Workmentioning

confidence: 99%

A New Approach of Botnet Activity Detection Models Using Combination of Univariate and ANOVA Feature Selection Techniques

2024

IJIES

View full text Add to dashboard Cite

show abstract

“…Taking into account the fact that the proposed traffic encapsulation system assumes the use of multi-factor authentication modules, two-way IP addresses verification, DNS caching services, as well as intelligent algorithms for predicting traffic consumption, it is proposed to use a decision-making system based on a tree structure [5,6]. This approach involves the use of nonparametric models that use sets of logical rules to predict the result [7].…”

Section: Development Of a Decision-making System Based On A Tree Stru...mentioning

confidence: 99%

Development of an intelligent decision-making system to support scientific and industrial formations VPN connections

Zaenchkovski,

Lazarev

2023

E3S Web Conf.

View full text Add to dashboard Cite

The development of information systems to ensure the safe coordination of information flows in scientific and industrial clusters makes it possible to automate a number of tasks aimed at increasing the cooperative interaction productivity. The use of existing traffic encapsulation solutions or the new client-server algorithms development for network interaction affects the decision-making component for managing the TCP/IP structure, authorization of subjects, and support for correct load distribution. At the moment, most VPN servers do not have the specified functionality, which does not allow integrating solutions into existing scientific and industrial clusters. As the main solution, a flexible decision support system is proposed that takes into account all aspects of the virtual tunnel software component. The proposed solution is based on the use of complex methods for assessing the software modules state to make decisions on changing the operation of functional modules. The development result of the proposed system and the conducted functional testing made it possible to automate the operation of VPN tunnels when working with a complex network interaction structure.

show abstract

Botnet‐based IoT network traffic analysis using deep learning

Singh,

Hoque,

Singh

et al. 2023

Security and Privacy

View full text Add to dashboard Cite

IoT networks are increasingly being connected to a wide range of devices, and the number of devices connected has significantly increased in recent years. As a consequence, the number of vulnerabilities to IoT networks has also been increasing tremendously. In IoT networks, botnet‐based Distributed Denial of Service attack is challenging due to its dynamic behavior. The sensors and actuators connected to IoT networks are low‐powered and have less memory. Because of their inherent vulnerability, IoT devices can always be compromised by an attacker and be used to form a large botnet. A detailed analysis of IoT botnet attacks is presented in this article, along with statistics and the architectures of the botnet. We also survey the existing literature on IoT botnet traffic analysis and present a taxonomy of attack detection methods. We particularly focus on deep learning‐based methods and conduct a comparative study to evaluate their performance on IoT traffic analysis. We identify the current issues and research challenges in this field, and we conclude by highlighting some future research directions.

show abstract

Real-time bot infection detection system using DNS fingerprinting and machine-learning

Cited by 9 publications

References 19 publications

A New Approach of Botnet Activity Detection Models Using Combination of Univariate and ANOVA Feature Selection Techniques

A New Approach of Botnet Activity Detection Models Using Combination of Univariate and ANOVA Feature Selection Techniques

Development of an intelligent decision-making system to support scientific and industrial formations VPN connections

Botnet‐based IoT network traffic analysis using deep learning

Contact Info

Product

Resources

About