Can we beat legitimate cyber behavior mimicking attacks from botnets?

Proceedings - IEEE INFOCOM

Volumn , Issue , 2012, Pages 2851-2855

  Yu, Shui ^a   Guo, Song ^b   Stojmenovic, Ivan ^c  

^a DEAKIN UNIVERSITY   (Australia)

^b UNIVERSITY OF AIZU   (Japan)

^c UNIVERSITY OF OTTAWA   (Canada)

Author keywords

botnet; detection; flash crowd attack; mimicking attack

Indexed keywords

BOTNET; BOTNETS; CYBER BEHAVIORS; CYBERSPACES; FLASH CROWD; ILLEGAL ACTIONS; LEGITIMATE USERS; MALICIOUS ACTIVITIES; MIMICKING ATTACK;

ERROR DETECTION; WEBSITES;

COMPUTER CRIME;

EID: 84861634583     PISSN: 0743166X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INFCOM.2012.6195714     Document Type: Conference Paper

References (29)

1. S. Yu, G. Zhao, S. Guo, Y. Xiang, and A. Vasilakos, "Browsing behavior mimicking attacks on popular websites," in INFOCOM Workshops, 2011, pp. 947-951.
2. M. Edman and B. Yener, "On anonymity in an electronic society: A survey of anonymous communication systems," ACM Computing Survey, vol. 42, no. 1, 2009.
3. B. Stone-Gross, M. Cova, L. Cavallaro, B. Gilbert, M. Szydlowski, R. Kemmerer, C. Kruegel, and G. Vigna, "Your botnet is my botnet: Analysis of a botnet takeover," in CCS '09: Proceedings of the 2009 ACM conference on computer communication security, 2009.
4. Z. Li, A. Goyal, Y. Chen, and V. Paxson, "Towards situational awareness of large-scale botnet probing events," IEEE Transactions on Information Forensics and Security, vol. 6, no. 1, pp. 175-188, 2011.
5. C. Shue, A. Kalafut, and M. Gupta, "Abnormally malicious autonomous systems and their internet connectivity," IEEE Transactions on Networking (in press).
6. M. A. Rajab, J. Zarfoss, F. Monrose, and A. Terzis, "My botnet is bigger than yours (maybe, better than yours): why size estimates remain challenging," in HotBots'07: Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, 2007.
7. N. Jiang, J. Cao, Y. Jin, L. E. Li, and Z.-L. Zhang, "Identifying suspicious activities through dns failure graph analysis," in Proceedings of the IEEE International Conference on Network Protocols, 2010, pp. 144-153.
8. S. Yadav, A. K. K. Reddy, A. L. N. Reddy, and S. Ranjan, "Detecting algorithmically generated malicious domain names," in Internet Measurement Conference, 2010, pp. 48-61.
9. V. L. L. Thing, M. Sloman, and N. Dulay, "A survey of bots used for distributed denial of service attacks," in SEC, 2007, pp. 229-240.
10. N. Ianelli and A. Hackworth, "Botnets as vehicle for online crime," in Proceedings of the 18th Annual FIRST Conference, 2006.
11. P. Wang, S. Sparks, and C. C. Zou, "An advanced hybrid peer-to-peer botnet," IEEE Transactions on Dependable and Secure Computing, vol. 7, no. 2, pp. 113-127, 2010.
12. S. Yu, W. Zhou, and R. Doss, "Information theory based detection against network behavior mimicking ddos attack," IEEE Communications Letters, vol. 12, no. 4, pp. 319-321, 2008.
13. A. Scherrer, N. Larrieu, P. Owezarski, P. Borgnat, and P. Abry, "Non-gaussian and long memory statistical characterizations for internet traffic with anomalies," IEEE Transactions on Dependable Secure Computing, vol. 4, no. 1, pp. 56-70, 2007.
14. A. El-Atawy, E. Al-Shaer, T. Tran, and R. Boutaba, "Adaptive early packet filtering for protecting firewalls against dos attacks," in Proceedings of the INFOCOM, 2009.
15. Y. Chen and K. Hwang, "Collaborative detection and filtering of shrew ddos attacks using spectral analysis," Journal of Parallel Distributed Computing, vol. 66, no. 9, pp. 1137-1151, 2006.
16. S. Kandula, D. Katabi, M. Jacob, and A. Berger, "Botz-4-sale: Surviving organized ddos attacks that mimic flash crowds (awarded best student paper)," in NSDI, 2005.
17. Y. Xie and S.-Z. Yu, "A large-scale hidden semi-markov model for anomaly detection on user browsing behaviors," IEEE/ACM Transactions on Networking, vol. 17, no. 1, pp. 54-65, 2009.
18. G. Oikonomou and J. Mirkovic, "Modeling human behavior for defense against flash-crowd attacks," in Proceedings of the 2009 IEEE conference on computer communication, 2009.
19. L. Breslau, P. Cao, L. Fan, G. Phillips, and S. Shenker, "Web caching and zipf-like distributions: Evidence and implications," in Proceedings of the INFOCOM, 1999, pp. 126-134.
20. Z. K. Silagadze, "Citations and the zipf-mandelbrot's law," Complex Systems, vol. 11, pp. 487-499, 1997.
21. M. E. Crovella and A. Bestavros, "Self-similarity in world wide web traffic: evidence and possible causes," IEEE/ACM Transactions on Networking, vol. 5, no. 6, pp. 835-846, 1997.
22. B. A. Huberman, P. L. T. Pirolli, J. E. Pitkow, and R. M. Lukose, "Strong regularities in world wide web surfing," Science, vol. 280, no. 3, 1998.
23. WorldCup98, http://ita.ee.lbl.gov/html/contrib/WorldCup.html.
24. NLANR, "Passive measurement and analysis (pma) project aucklandviii,"http://pma.nlanr.net/Special/auck8.html.
25. Z. Duan, X. Yuan, and J. Chandrashekar, "Controlling ip spoofing through interdomain packet filters," IEEE Trans. Dependable Sec. Comput., vol. 5, no. 1, pp. 22-36, 2008.
26. H. Wang, C. Jin, and K. G. Shin, "Defense against spoofed ip traffic using hop-count filtering," IEEE/ACM Trans. Netw., vol. 15, no. 1, pp. 40-53, 2007.
27. Y. Kim, W. C. Lau, M. C. Chuah, and H. J. Chao, "Packetscore: A statistics-based packet filtering scheme against distributed denial-ofservice attacks," IEEE Trans. Dependable Sec. Comput., vol. 3, no. 2, pp. 141-155, 2006.
28. M. Bailey, E. Cooke, F. Jahanian, Y. Xu, and M. Karir, "A survey of botnet technology and defenses," in Proceedings of the 2009 cybersecurity applications and technology conference for Homeland security, 2009.
29. D. Dagon, C. Zou, and W. Lee, "Modeling botnet propagation using time zones," in Proceedings of the 13 th Network and Distributed System Security Symposium NDSS, 2006.