Detecting stealthy P2P botnets using statistical traffic fingerprints

Proceedings of the International Conference on Dependable Systems and Networks

Volumn , Issue , 2011, Pages 121-132

  Zhang, Junjie ^a   Perdisci, Roberto ^b   Lee, Wenke ^a   Sarfraz, Unum ^a   Luo, Xiapu ^c  

^a GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

^b UNIVERSITY OF GEORGIA   (United States)

^c HONG KONG POLYTECHNIC UNIVERSITY   (Hong Kong)

Author keywords

Botnet; Intrusion Detection; P2P; Security

Indexed keywords

BOTNET; BOTNETS; CURRENT DETECTION; DETECTION ACCURACY; DETECTION SYSTEM; EXPERIMENTAL EVALUATION; FALSE POSITIVE RATES; MALICIOUS ACTIVITIES; P2P; P2P APPLICATIONS; P2P COMMUNICATIONS; PEER TO PEER; REAL WORLD DATA; SECURITY;

DISTRIBUTED COMPUTER SYSTEMS; INTRUSION DETECTION;

PEER TO PEER NETWORKS;

EID: 80051935855     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/DSN.2011.5958212     Document Type: Conference Paper

References (23)

1. Argus: Auditing network activity. http://www.qosient.com/argus/.
2. Autoit script. http://www.autoitscript.com/autoit3/index.shtml.
3. A.W. Moore and D. Zuev. Internet traffic classification using Bayesian analysis techniques. In ACM SIGMETRICS, 2005.
4. D. Stutzbach and R. Rejaie. Understanding churn in peer-to-peer networks. In ACM SIGCOMM Internet Measurement Conf, 2006.
5. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee. Bothunter: Detecting malware infection through IDS-driven dialog correlation. In Proc. USENIX Security, 2007.
6. G. Gu, R. Perdisci, J. Zhang, and W. Lee. Botminer: Clustering analysis of network traffic for protocol-and structure-independent botnet detection. In Proc. USENIX Security, 2008.
7. M. Halkidi, Y. Batistakis, and M. Vazirgiannis. On clustering validation techniques. J. Intell. Inf. Syst., 17(2-3):107-145, 2001. (Pubitemid 34050790)
8. T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling. Measurements and mitigation of peer-to-peer-based botnets: A case study on storm worm. In Proc. USENIX LEET, 2008.
9. B. Kang, E. C. Tin, and C. P. Lee. Towards complete node enumeration in a peer-to-peer botnet. In Proc. ACM ASIACCS, 2009.
10. R. Lemos. Bot software looks to improve peerage. Http://www. securityfocus.com/news/11390, 2006.
11. Z. Li, A. Goyal, Y. Chen, and A. Kuzmanovic. Measurement and diagnosis of address misconfigured p2p traffic. In IEEE INFOCOM 2010, 2010.
12. M.P. Collins and M. K. Reiter. Finding peer-to-peer file sharing using coarse network behaviors. In Proc. ESORICS, 2006.
13. P. Porras, H. Saidi, and V. Yegneswaran. A multi-perspective analysis of the storm (peacomm) worm. In Computer Science Laboratory, SRI International, Technical Report, 2007.
14. P. Porras, H. Saidi, and V. Yegneswaran. Conficker c analysis. http://mtc.sri.com/Conficker/addendumC/index.html, 2009.
15. S. Nagaraja and P. Mittal and C.-Y. Hong and M. Caesar and N. Borisov. Botgrep: Finding p2p bots with structured graph analysis. In Proc. USENIX Security, 2010.
16. S. Sen, O. Spatscheck, and D. Wang. Accurate, scalable in-network identication of p2p traffic using application signatures. In WWW, 2004.
17. G. Sinclair, C. Nunnery, and B. B. Kang. The waledac protocol: The how and why. In Intl. Conf. Malicious and Unwanted Software, 2009.
18. S. Stover, D. Dittrich, J. Hernandez, and S. Dietrich. Analysis of the storm and nugache trojans: P2p is here. In USENIX; login, vol. 32, no. 6, 2007.
19. T.-F. Yen and M. K. Reiter. Are your hosts trading or plotting? Telling p2p file-sharing and bots apart. In ICDCS, 2010.
20. T. Karagiannis, A.Broido, M. Faloutsos, and Kc Claffy. Transport layer identification of p2p traffic. In ACM IMC, 2004.
21. T. Karagiannis and K. Papagiannaki and M. Faloutsos. Blinc: Multilevel traffic classification in the dark. In ACM SIGCOMM, 2005.
22. Y. Zhao and Y. Xie and F. Yu and Q. Ke and Y. Yu. Botgraph: Large scale spamming botnet detection. In Proc. USENIX NSDI, 2009.
23. T. Zhang, R. Ramakrishnan, and M. Livny. Birch: An efficient data clustering method for very large databases. In Proc. ACM SIGMOD. ACM Press, 1996.