Clustering botnet communication traffic based on n-gram feature selection

Computer Communications

Volumn 34, Issue 3, 2011, Pages 502-514

  Lu, Wei ^a   Rammidi, Goaletsa ^a   Ghorbani, Ali A ^a  

^a UNIVERSITY OF NEW BRUNSWICK   (Canada)

Author keywords

Botnet detection; Clustering; Machine learning

Indexed keywords

BOTNET DETECTION; BOTNETS; CLUSTERING; COMMUNICATION TRAFFICS; CONTENT-BASED; DECISION TREE MODELS; DETECTION APPROACH; ENCRYPTED TRAFFIC; FALSE ALARM RATE; FEATURE SELECTION; HIGH DETECTION RATE; HONEYPOTS; HUMAN BEING; INTERNET INFRASTRUCTURE; LARGE-SCALE NETWORK; MACHINE-LEARNING; NETWORK FLOWS; NETWORK LINKS; NETWORK TRAFFIC; NEW APPROACHES; ON CURRENTS; PEER TO PEER; SECURITY THREATS; TRAFFIC TRACES;

CRYPTOGRAPHY; DECISION TREES; FEATURE EXTRACTION; LEARNING SYSTEMS; NETWORK SECURITY;

HTTP;

EID: 78751649445     PISSN: 01403664     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.comcom.2010.04.007     Document Type: Article

References (42)

1. Symantec Internet Security Threat Report.
2. Taxonomy of Botnet Threats. .
3. K. Chiang, L. Lloyd, A case study of the rustock rootkit and spam bot, in: Proceedings of USENIX HotBots, 2007.
4. N. Daswani, M. Stoppelman, The anatomy of clickbot. A., in: Proceedings of USENIX HotBots, 2007.
5. Sinit. , 2008.
6. Phatbot. , 2008.
7. Nugache. , 2008.
8. Storm Worm Analysis. .
9. T. Holz, M. Steiner, F. Dahl, E. Biersack, F. Freiling, Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm, in: Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats.
10. G. Gu, R. Perdisci, J. Zhang, W. Lee, BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection, in: Proceedings of the 17th USENIX Security Symposium (Security'08), 2008.
11. T. Strayer, D. Lapsley, R. Walsh, C. Livadas, Botnet Detection: Countering the Largest Security Threat, vol. 36, Chapter Botnet Detection Based on Network Behavior, Springer, 2008.
12. C. Livadas, R. Walsh, D. Lapsley, T. Strayer, Using machine learning techniques to identify botnet traffic, in: Proceedings 2006 31st IEEE Conference on Local Computer Networks, 2006, pp. 967-974.
13. W. Wang, B. Fang, Z. Zhang, C. Li, A novel approach to detect IRC-based botnets, in: International Conference on Networks Security, Wireless Communications and Trusted Computing, Wuhan, Hubei, 2009, pp. 408-411.
14. J. Goebel, T. Holz, Rishi: identify bot contaminated hosts by irc nickname evaluation, in: HotBots'07: Proceedings of the First Conference on First Workshop on Hot Topics in Understanding Botnets, Berkeley, CA, USA, 2007 (USENIX Association).
15. P. Sroufe, S. Phithakkitnukoon, R. Dantu, J. Cangussu, Email shape analysis for spam botnet detection, in: Sixth IEEE Consumer Communications and Networking Conference, Las Vegas, NV, January 2009, pp. 1-2.
16. A. Brodsky, D. Brodsky, A distributed content independent method for spam detection, in: Proceedings of the First Conference on First Workshop on Hot Topics in Understanding Botnets, Cambridge, MA, 2007, p. 3.
17. Y. Zhao, Y.L. Xie, F. Yu, Q.F. Ke, Y. Yu, Y. Chen, E. Gillum, BotGraph: large-scale spamming botnet detection, in: Proceedings of the 6th USENIX Symposium on Networked Systems Design and Implementation, 2008, pp. 321-334.
18. G. Gu, J. Zhang, W. Lee, BotSniffer: Detecting botnet command and control channels in network traffic, in: Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS'08), 2008.
19. J.R. Binkley, S. Singh, An algorithm for anomaly-based botnet detection, in: USENIX SRUTI: 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet, 2006.
20. M.M. Masud, J. Gao, L. Khan, B. Thuraisingham, Peer to peer botnet detection for cyber-security: a data mining approach, in: Proceedings of the 4th Annual Workshop on Cyber Security and Information Intelligence Research: Developing Strategies to Meet the Cyber Security and Information Intelligence Challenges Ahead, Oak Ridge, Tennessee, 2008.
21. R. Villamarín-Salomón, J.C. Brustoloni, Bayesian bot detection based on DNS traffic similarity, in: Proceedings of the 2009 ACM Symposium on Applied Computing, Honolulu, Hawaii, 2009, pp. 2035-2041.
22. Y. Kugisaki, Y. Kasahara, Y. Hori, K. Sakurai, Bot detection based on traffic analysis, in: The 2007 International Conference on Intelligent Pervasive Computing, Jeju City, October 2007, pp. 303-306.
23. E. Stinson, J.C. Mitchell, Towards systematic evaluation of the evadability of bot/botnet detection methods, in: Workshop On Offensive Technologies (WOOT), San Jose, CA, USA, 2008.
24. H. Choi, H. Lee, H. Kim, Botnet detection by monitoring group activities in DNS traffic, in: International Conference on Computer and Information Technology, Aizu-Wakamatsu, Fukushima, 2007, pp. 715-720.
25. R. Villamarin-Salomon, J.C. Brustoloni, Identifying botnets using anomaly detection techniques applied to DNS traffic, in: Fifth IEEE Consumer Communications and Networking Conference, Las Vegas, NV, 2008, pp. 476-481.
26. IANA Port Numbers. , 2008.
27. J. Erman, A. Mahanti, M. Arlitt, I. Cohen, and C. Williamson Offline/realtime traffic classification using semi-supervised learning Performance Evaluation 64 9-12 2007 1194 1213
28. L. Bernaille, R. Teixeira, I. Akodkenou, A. Soule, and K. Salamatian Traffic classification on the fly ACM SIGCOMM Computer Communication Review 36 2 2006 23 26
29. L. Bernaille, R. Teixeira, Early recognition of encrypted applications, in: Proceedings of Passive and Active Measurement Conference (PAM 2007), Louvain-la-neuve, Belgium, 2007, pp. 165-175.
30. S. Sen, J. Wang, Analyzing peer-to-peer traffic across large networks, in: Proceedings of ACM SIGCOMM Internet Measurement Workshop, Marseilles, France, 2002.
31. A. Moore, K. Papagiannaki, Toward the accurate identification of network applications, in: Proceedings of 6th Passive and Active Measurement Workshop (PAM 2005), 2005.
32. T. Karagiannis, K. Papagiannaki, M. Faloutsos, BLINC: multilevel traffic classification in the dark, in: Proceedings of the 2005 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, Philadelphia, Pennsylvania, 2005, pp. 229-240.
33. L. Salgarelli, F. Gringoli, and T. Karagiannis Comparing traffic classifiers ACM SIGCOMM Computer Communication Review 37 3 2008 65 68
34. Fred-eZone WiFi ISP. , 2008.
35. K. Wang, S. Stolfo, Anomalous payload-based network intrusion detection, in: Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection (RAID), Sophia Antipolis, France, 2004.
36. G.F. Gu, P. Porras, V. Yegneswaran, M. Fong, W.K. Lee, BotHunter: detecting malware infection through IDS-Driven dialog correlation, in: Proceedings of the 16th USENIX Security Symposium, Boston, MA, 2007.
37. J.R. Quinlan C4.5: Programs for Machine Learning 1993 Morgan Kaufman Publishers
38. M. Akiyama, T. Kawamoto, M. Shimamura, T. Yokoyama, Y. Kadobayashi, S. Yamaguchi, A proposal of metrics for botnet detection based on its cooperative behavior, in: Proceedings of the 2007 International Symposium on Applications and the Internet Workshops, 2007, pp. 82-85.
39. E. Eskin, Anomaly detection over noisy data using learned probability distributions, in: Proceedings of 17th International Conference on Machine Learning, pp. 255-262.
40. D. Pelleg, A. Moore, X-means: extending K-means with efficient estimation of the number of clusters, in: Proceedings of the Seventeenth International Conference on Machine Learning, 2000, pp. 727-734.
41. Kaiten. , 2008.
42. Blackenergy. , BlackEnergy.