Boosting the scalability of botnet detection using adaptive traffic sampling

Proceedings of the 6th International Symposium on Information, Computer and Communications Security, ASIACCS 2011

Volumn , Issue , 2011, Pages 124-134

  Zhang, Junjie ^a   Luo, Xiapu ^c   Perdisci, Roberto ^b   Gu, Guofei ^d   Lee, Wenke ^a   Feamster, Nick ^a  

^a GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

^b UNIVERSITY OF GEORGIA   (United States)

^c HONG KONG POLYTECHNIC UNIVERSITY   (Hong Kong)

^d TEXAS A AND M UNIVERSITY   (United States)

Author keywords

Adaptive sampling; Botnet; Intrusion detection; Network security

Indexed keywords

BOTNET; HEALTH RISKS; HIGH SPEED NETWORKS; NETWORK SECURITY; SCALABILITY;

'CURRENT; ADAPTIVE SAMPLING; BOTNET DETECTIONS; BOTNETS; DEEP PACKET INSPECTION; DETECTION SYSTEM; INTRUSION-DETECTION; NETWORK-BASED; NETWORKS SECURITY; TRAFFIC SAMPLING;

INTRUSION DETECTION;

EID: 79956014847     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1966913.1966930     Document Type: Conference Paper

References (24)

1. A. Kumar and J. Xu. Sketch guided sampling - using on-line estimates of ow size for adaptive data collection. In Proc. IEEE Infocom, 2006.
2. A. Ramachandran, S. Seetharaman, and N. Feamster. Fast monitoring of traffic subpopulations. In Proc. ACM IMC, 2008.
3. R. K. B. Yang and D.A.McGrew. Divide and concatenate: An architectural level optimization technique for universal hash functions. In Proc. of the Design Automation Conference, 2004.
4. J. R. Binkley and S. Singh. An algorithm for anomaly-based botnet detection. In Proc. USENIX SRUTI, 2006.
5. G. Gu, J. Zhang, and W. Lee. Botsniffer: Detecting botnet command and control channels in network traffic. In Proc. NDSS, 2008.
6. G. Gu, P. Porras, V. Yegneswaran, M. Fong, W. and Lee. Bothunter: Detecting malware infection through IDS-driven dialog correlation. In Proc. USENIX Security, 2007.
7. G. Gu, R. Perdisci, J. Zhang, and W. Lee. Botminer: Clustering analysis of network traffic for protocol- and structure-independent botnet detection. In Proc. USENIX Security, 2008.
8. J. Goebel and T. Holz. Rishi: identify bot contaminated hosts by irc nickname evaluation. In Proc. USENIX HotBots, 2007.
9. C. Hu, S. Wang, J. Tian, B. Liu, Y. Cheng, and Y. Chen. Accurate and efficient traffic monitoring using adaptive non-linear sampling method. In Proc. IEEE Infocom, 2008.
10. Infosecurity. Storm deadnet reanimates as waledac botnet. http://infosecurity.us/?p=6262 2009.
11. B. Kang, E. C. Tin, and C. P. Lee. Towards complete node enumeration in a peer-to-peer botnet. In Proc. ACM AISACCS, 2009.
12. A. Karasaridis, B. Rexroad, and D. Hoein. Wide-scale botnet detection and characterization. In Proc. USENIX HotBots, 2007.
13. C. P. Lee. FRAMEWORK FOR BOTNET EMULATION AND ANALYSIS. PhD thesis, Georgia Institute of Technology, Atlanta, GA, Nov. 2008.
14. C. Livadas, R. Walsh, D. Lapsley, and W. T. Strayer. Using machine learning techniques to identify botnet traffic. In Proc. IEEE WoNS, 2006.
15. A. Ramachandran, N. Feamster, and D. Dagon. Revealing botnet membership using DNSBL counter-intelligence. In Proc. USENIX SRUTI, 2006.
16. B. Stone-Gross, A. Moser, C. Kruegel, E. Kirda, and K. Almeroth. Fire: Finding rogue networks. In Proc. ACSAC, 2009.
17. W. T. Strayer, R. Walsh, C. Livadas, and D. Lapsley. Detecting botnets with tight command and control. In Proc. IEEE LCN, 2006.
18. T.-F. Yen and M. K. Reiter. Are your hosts trading or plotting? telling p2p file-sharing and bots apart. In ICDCS, 2010.
19. L. P. Wenjia Fang. Inter-as traffic patterns and their implications. In IEEE Global Internet Symposium, 1999.
20. X. Hu, M. Knysz and K. Shin. Rb-seeker: Auto-detection of redirection botnets. In Proc. NDSS, 2009.
21. Y. Zhang, S. Singh, S. Sen, N. Duffield and C. Lund. Online identification of hierarchical heavy hitters: Algorithms, evaluation, and applications. In Proc. ACM IMC, 2004.
22. Y. Zhao and Y. Xie and F. Yu and Q. Ke and Y. Yu. Botgraph: Large scale spamming botnet detection. In Proc. USENIX NSDI, 2009.
23. T.-F. Yen and M. K. Reiter. Traffic aggregation for malware detection. In Proc. DIMVA, 2008.
24. T. Zhang, R. Ramakrishnan, and M. Livny. Birch: An efficient data clustering method for very large databases. In Proc. ACM SIGMOD. ACM Press, 1996.