The Botnet Simulator: A simulation tool for understanding the interaction between botnets

Vignau, Benjamin; Khoury, Raphaël; Hallé, Stéphane; Hamou-Lladj, Abdelwahab

doi:10.1016/j.simpa.2021.100173

Cited by 3 publications

(3 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A few studies present simulation tools for botnet behavior [e.g., Kotenko et al 2010;Vignau et al 2021], but their focus is on the interaction between bots and defense strategies on a defender-attacker setting without considering the network topology. Kotenko et al (2010) presents an agent-based simulation tool for the interaction of the botnet with the defense strate-gies in an attacker-defender setting.…”

Section: Existing Graph Simulatorsmentioning

confidence: 99%

“…Kotenko et al (2010) presents an agent-based simulation tool for the interaction of the botnet with the defense strate-gies in an attacker-defender setting. Vignau et al (2021) presents a simulation tool for predicting the interaction among different bots and how different botnet design strategies/features affect the spread of botnet in a dynamic competitive environment, where multiple bots compete for the same target. The authors ignore the network topology and the critical graph properties (e.g., community structure), considering only a set of potential targets for the bots.…”

Section: Existing Graph Simulatorsmentioning

confidence: 99%

“…This triggers the need for an efficient scalable graph simulation algorithm to generate real-life, large-scale graphs with botnet traffic regardless of a specific botnet behavior. Despite there exists a few botnet behavior simulation tools [e.g., Kotenko et al 2010;Vignau et al 2021], their focus is not to generate a large-scale, real-life botnet dataset containing both normal and botnet traffic while maintaining critical graph properties. Therefore, to the best of our knowledge, there does not exist a scalable graph simulation algorithm for generating real-life, large-scale graphs with botnet traffic.…”

Section: Research Gapmentioning

confidence: 99%

See 2 more Smart Citations

Scalable Simulation Algorithm to Generate Large-Scale Botnet Dataset using Role-Mining and Markov Chain

Bhuiyan

Harun

Zhang

et al. 2023

Preprint

View full text Add to dashboard Cite

Detection of malicious networks (botnet) is becoming a major concern as they pose a serious threat to network security. But, botnet detection methods often perform very poorly in real-life datasets as the methods are not developed based on a real-life botnet dataset. A crucial reason for the detection methods not being developed based on a real-life dataset is the scarcity of large-scale, real-life botnet datasets. Due to security and privacy concerns, organizations do not publish their real-life botnet dataset. Realizing the need for a real-life large-scale botnet dataset, in this paper, we develop a simulation methodology to simulate a large-scale botnet dataset from a real-life botnet dataset. This simulation methodology is based on the Markov chain and role-mining approaches. Besides simulating the degree distribution, our simulation methodology also simulates triangles (community structures). We propose a novel scalable algorithm using parallel computing that generates large-scale botnet graphs from a small-size input dataset. To evaluate the performance of our simulation methodology, we compare our simulated graph with the original graph and with the graph simulated by the Preferential attachment (PA) algorithm based on the distributions of triangles, indegrees, and outdegrees. Results demonstrate that the distributions of the simulated graph generated by our methodology are very similar to the distributions of the original graph with minor real-life random variations. Results also demonstrate that our simulation algorithm substantially outperforms the PA algorithm in simulating the distributions of triangles and botnet subgraphs. To emphasize the accuracy of botnet simulation more, we provide a separate comparison between the botnet subgraphs of the simulated and the original graphs that demonstrates the similarity of our simulated botnet subgraphs with the original botnet subgraph. A comparison of our simulated scaled-up graph with the original graph demonstrates that our methodology preserves the triangle distribution and the botnet subgraphs of the original graph, whereas the PA algorithm fails to preserve the triangle distribution and the botnet subgraphs in the scaled-up graph.

show abstract

Section: Existing Graph Simulatorsmentioning

confidence: 99%

Section: Existing Graph Simulatorsmentioning

confidence: 99%

Section: Research Gapmentioning

confidence: 99%

See 1 more Smart Citation