Detecting botnets using command and control traffic

Proceedings - 2009 8th IEEE International Symposium on Network Computing and Applications, NCA 2009

Volumn , Issue , 2009, Pages 156-162

  AsSadhan, Basil ^a   Moura, José M F ^a   Lapsley, David ^b   Jones, Christine ^b   Strayer, W Timothy ^b  

^a CARNEGIE MELLON UNIVERSITY   (United States)

^b BBN TECHNOLOGIES   (United States)

Author keywords

Botnet detection; Discrete time series analysis; Periodogram; SLINGbot; Walker large sample test

Indexed keywords

BOTNET DETECTION; DISCRETE TIME SERIES ANALYSIS; PERIODOGRAM; SLINGBOT; WALKER LARGE SAMPLE TEST;

COMMUNICATION; COMPUTER SCIENCE; CONTINUOUS TIME SYSTEMS; DAMAGE DETECTION; INTERNET PROTOCOLS; TELECOMMUNICATION TRAFFIC; TESTING; TIME SERIES;

TIME SERIES ANALYSIS;

EID: 70449416204     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/NCA.2009.56     Document Type: Conference Paper

References (20)

1. "Over 1 million potential victims of botnet cyber crime," FBI Press Release, Jun. 13, 2007.
2. "'Bot roast II' nets 8 individuals," FBI Press Release, Nov. 29, 2007.
3. "Symantec global internet security threat report, trends for July- December 07, volume XIII," Symantec Corp, Apr. 2008.
4. J. Leyden, "Most spam comes from just six botnets," The Register, Feb. 29, 2008.
5. T. Weber, "Criminals 'may overwhelm the web'," BBC News, Jan. 25, 2007.
6. G. Gu, J. Zhang, and W. Lee, "BotSniffer: Detecting botnet command and control channels in network traffic," in the 15th Annual Network and Distributed System Security Symposium (NDSS'08), San Diego, CA, USA, Feb. 10-13, 2008.
7. A. Oppenheim, R. Schafer, and J. Buck, Discrete-Time Signal Processing. Prentice-Hall, 1999.
8. M. B. Priestley, Spectral Analysis and Time Series. Academic Press, 1982.
9. G. Gu, R. Perdisci, J. Zhang, and W. Lee, "BotMiner: Clustering analysis of network traffic for protocol and structure-independent botnet detection," in the 17th USENIX Security Symposium (Security'08), San Jose, CA, USA, Jul. 28-Aug. 1, 2008.
10. B. AsSadhan, H. Kim, and J. M. F. Moura, "Long-range dependence analysis of control and data planes network traffic," in Saudi International Innovation Conference (SIIC), Leeds, UK, Jun. 9-10, 2008.
11. B. AsSadhan, H. Kim, J. M. F. Moura, and X. Wang, "Network traffic behavior analysis by decomposition into control and data planes," in InternationalWorkshop on Security in Systems and Networks (SSN) with conjunction of IEEE International Parallel and Distributed Processing Symposium (IPDPS), Miami, FL, USA, Apr. 18, 2008.
12. C. Partridge, D. Cousins, A. W. Jackson, R. Krishnan, T. Saxena, and W. T. Strayer, "Using signal processing to analyze wireless data traffic," in ACM Workshop on Wireless Security (WiSe), Atlanta, GA, USA, Sep. 2002, pp. 67-76.
13. K. Fukunaga, Statistical Pattern Recognition, 2nd ed. Academic Press, 1990.
14. H. V. Trees, Detection, Estimation, and Modulation Theory. Part 1. John Wiley & Sons, 2001.
15. B. AsSadhan, J. M. F. Moura, and D. Lapsley, "Periodic behavior in botnet command and control channels traffic," unpublished.
16. A. Leon-Garcia, Probability and Random Processes for Electrical Engineering. Addison Wesley, 1994.
17. A. W. Jackson, D. Lapsley, C. Jones, M. Zatko, C. Golubitsky, and W. T. Strayer, "SLINGbot: A system for live investigation of next generation botnets," in Cybersecurity Application and Technologies Conference for Homeland Security (CATCH), Washington, DC, USA, Mar. 2009.
18. "Taxonomy of botnet threats," TrenMicro, Technical report, Nov. 2006.
19. "LBNL/ICSI enterprise tracing project," http://www.icir.org/ enterprisetracing/,2005.
20. R. Pang, M. Allman, M. Bennett, J. Lee, V. Paxson, and B. Tierney, "A first look at modern enterprise traffic," in ACM SIGCOMM/USENIX Internet Measurement Conference, Berkeley, CA, USA, Oct. 2005, pp. 15-28.