Detection of botnets using combined host- and network-level information

Proceedings of the International Conference on Dependable Systems and Networks

Volumn , Issue , 2010, Pages 291-300

  Zeng, Yuanyuan ^a   Hu, Xin ^a   Shin, Kang G ^a  

^a UNIVERSITY OF MICHIGAN   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNETS; COMMAND AND CONTROL; COMPUTATIONAL OVERHEADS; DETECTION APPROACH; DETECTION FRAMEWORK; FALSE-ALARM RATES; INTERNET SERVICES; MALICIOUS BEHAVIOR; MALWARES; NETWORK LEVEL; NETWORK TRAFFIC ANALYSIS; PRIVACY CONCERNS;

COMPUTER CRIME; INTERNET;

INTERNET PROTOCOLS;

EID: 77956602969     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DSN.2010.5544306     Document Type: Conference Paper

References (24)

1. Netfiow. http://www.manageengine.com/products/netflow/cisco-netflow.html.
2. Passmark. http://www.passmark.com/.
3. pvclust package. http://www.is.titech.ac.jp/shimo/prog/pvclustl.
4. Storm worm. http://en.wikipedia.org/wiki/Storm-Worm.
5. J. R. Binkley and S. Singh. An algorithm for anomaly-based botnet detection. In Proceedings of the 2nd conference on Steps to Reducing Unwanted Traffic on the Internet, 2006.
6. M. Christodorescu, S. Jha, S. A. Seshia, D. Song, and R. E. Bryant. Semantics-aware malware detection. In Proceedings of IEEE Symposium on Security and Privacy, 2005.
7. E.F.Glynn. Correlation "distances" and hierarchical clustering. http://research.stowers-institute.org/efg/RNisualization/cor-cluster/index.htm, 2005.
8. S. Forrest, S. A. Hofmeyr, A. Somayaji, and T. A. Longstaff. A sense of self for unix processes. IEEE Symposium on Security and Privacy, 1996.
9. S. Foundation. Waledac is storm is waledac? peer-to-peer over http. http2p? http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20081231, 2008.
10. J. Goebel and T. Holz. Rishi: Identify bot contaminated hosts by irc nickname evaluation. In HotBots'07: Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, 2007.
11. G. Gu, R. Perdisci, J. Zhang, and W. Lee. BotMiner: Clustering analysis of network traffic for protocol- and structure- independent botnet detection. In Proceedings of the 17th USENIX Security Symposium, 2008.
12. G. Gu, J. Zhang, and W. Lee. Botsniffer: Detecting botnet command and control channels in network traffic. In In Proc. of the 15th Annual Network and Distributed System Security Symposium (NDSS), 2008.
13. T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling. Measurements and mitigation of peer-to-peer-based botnets: A case study on storm worm. In Proc. First USENIX Workshop on Large-scale Exploits and Emergent Threats, 2008.
14. A. Karasaridis, B. Rexroad, and D. Hoeflin. Wide-scale botnet detection and characterization. In HotBots'07, 2007.
15. E. Kirda, C. Kruegel, G. Banks, G. Vigna, and R. Kemmerer. Behavior-based spyware detection. In Proceedings ofthe 15th USENIX Security Symposium, 2006.
16. H. Lin, C. Lin, and R. Weng. A note on platt's probabilistic outputs for support vector machines, 2003.
17. C. Livadas, R. Walsh, D. Lapsley, and W. Strayer. Using machine learning technliques to identify botnet traffic. In Proceedings of the 2nd IEEE LCN Workshop, Nov, 2006.
18. J. Nazario. Walking waledac. http://asert.arbornetworks.com/2009/01/ walking-waledec/, 2009.
19. P. Porras, H. Saidi, and V. Yegneswaran. A multi-perspective analysis of the storm worm. Technical report, SRI, 2007.
20. R. Sekar, M. Bendre, P. Bollineni, and D. Dhurjati. A fast automaton-based method for detecting anomalous program behaviors. In Proceedings of the IEEE Symposium on Security and Privacy, 2001.
21. A. Somayaji and S. Forrest. Automated response using system-call delays. In Proc. of the USENIX Security, 2000.
22. W. T. Strayer, R.Walsh, C. Livadas, and D. Lapsley. Detecting botnets with tight command and control. In Proceedings ofthe 31st IEEE LCN, November, 2006.
23. T. Yen and M. K. Reiter. Traffic aggregation for malware detection. In Proceedings of the 5th GI International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), 2008.
24. Y. Zeng, X. Hu, A. Bose, H. Wang, and K. G. Shin. Containment of network worms via per-process rate-limiting. In Proceedings of 4th International Conference on Security and Privacy in Communication Networks (SecureComm), 2008.