A novel IRC botnet detection method based on packet size sequence

IEEE International Conference on Communications

Volumn , Issue , 2010, Pages

  Ma, Xiaobo ^a   Guan, Xiaohong ^a,b   Tao, Jing ^a   Zheng, Qinghua ^a   Guo, Yun ^a   Liu, Lu ^a   Zhao, Shuang ^a  

^a XI'AN JIAOTONG UNIVERSITY   (China)

^b TSINGHUA NATIONAL LABORATORY FOR INFORMATION SCIENCE AND TECHNOLOGY   (China)

Author keywords

Botnet; IRC; Quasi periodicity; Ukkonen

Indexed keywords

AVERAGE SIZE; BOTNETS; COMMAND AND CONTROL; DETECTION METHODS; FALSE POSITIVE RATES; HONEYNET; INFORMATION THEFTS; PACKET SIZE; QUASI-PERIODICITIES; REAL-WORLD;

INTERNET; SPEECH COMMUNICATION;

TRANSMISSION CONTROL PROTOCOL;

EID: 77955382717     PISSN: 05361486     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICC.2010.5502092     Document Type: Conference Paper

References (19)

1. D. Dagon, G. Guofei and C. P. Lee, and L. Wenke, "A Taxonomy of Botnet Structures," in Computer Security Applications Conference, 2007. ACSAC 2007. Twenty-Third Annual, 2007, p. 325-339.
2. "The Honeynet Project ,".http://www.honeynet.org/
3. V. Y. Paul Barford, "An Inside Look at Botnets," in Special Workshop on Malware Detection, Advances in Information Security, Arlington, VA, 2006.
4. D. Dittrich and S. Dietrich, "P2P as botnet command and control: A deeper insight," in Malicious and Unwanted Software, 2008. MALWARE 2008. 3rd International Conference on, 2008, p. 41-48.
5. "Know Your Enemy:Fast-Flux Service Networks," : The Honeynet Project & Research Alliance, 2007.
6. "Know your enemy: Tracking botnets," : The Honeynet Project, 2005.
7. H. Choi, H. Lee and H. Lee, and H. Kim, "Botnet Detection by Monitoring Group Activities in DNS Traffic," in Computer and Information Technology, 2007. CIT 2007. 7th IEEE International Conference on, 2007, p. 715-720.
8. R. Villamarin-Salomon and J. C. Brustoloni, "Identifying Botnets Using Anomaly Detection Techniques Applied to DNS Traffic," in Consumer Communications and Networking Conference, 2008. CCNC 2008. 5th IEEE, 2008, p. 476-481.
9. A. Ramachandran, N. Feamster and D. Dagon, "Revealing botnet membership using DNSBL counter-intelligence," in Proceedings of the 2nd conference on Steps to Reducing Unwanted Traffic on the Internet, 2006, p. 8-8.
10. M. A. Rajab, J. Zarfoss and F. Monrose, and A. Terzis, "A multifaceted approach to understanding the botnet phenomenon," in Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, 2006, p. 41-52.
11. J. R. Binkley and S. Singh, "An Algorithm for Anomaly-based Botnet Detection,".
12. J. Goebel and T. Holz, "Rishi: Identify bot contaminated hosts by irc nickname evaluation," in In USENIX Workshop on Hot Topics in Understanding Botnets (HotBots'07), 2007.
13. C. Livadas, R. Walsh and D. Lapsley, and W. T. Strayer, "Usilng Machine Learning Technliques to Identify Botnet Traffic," in Local Computer Networks, Proceedings 2006 31st IEEE Conference on, 2006, p. 967-974.
14. G. Gu, P. Porras and V. Yegneswaran, M. Fong, and W. Lee, "BotHunter: Detecting malware infection through IDS-driven dialog correlation.," in In Proceedings of the 16th USENIX Security Symp. (Security 2007), 2007.
15. G. Gu, J. Zhang and W. Lee, "BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic," in In Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS'08), 2008.
16. G. Gu, R. Perdisci and J. Zhang, and W. Lee, "BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection," in 17th USENIX Security Symposium (USENIX Security '08), 2008.
17. Y. Kugisaki, Y. Kasahara and Y. Hori, and K. Sakurai, "Bot Detection Based on Traffic Analysis," in Intelligent Pervasive Computing, 2007. IPC. The 2007 International Conference on, 2007, p. 303-306.
18. S. Zander, T. Nguyen and G. Armitage, "Automated traffic classification and application identification using machine learning," in Local Computer Networks, 2005. 30th Anniversary. The IEEE Conference on, 2005, p. 250-257.
19. E. Ukkonen, "On-line construction of suffix trees," Algorithmica, vol. 14, p. 249-260, 1995.