Disclosure: Detecting botnet command and control servers through large-scale NetFlow analysis

ACM International Conference Proceeding Series

Volumn , Issue , 2012, Pages 129-138

  Bilge, Leyla ^a   Balzarotti, Davide ^b   Robertson, William ^c   Kirda, Engin ^c   Kruegel, Christopher ^d  

^a SYMANTEC RESEARCH LABS   (United States)

^b EURECOM   (France)

^c NORTHEASTERN UNIVERSITY   (United States)

^d UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNETS; CLIENT ACCESS PATTERNS; COMMAND AND CONTROL; DATA SETS; DETECTION SYSTEM; FALSE POSITIVE RATES; FLOW SIZES; LARGE-SCALE NETFLOW ANALYSIS; NETFLOW DATA; NETFLOWS; NETWORK DATA; NOVEL TECHNIQUES; PRIMARY FACTORS; REAL-TIME DETECTION; REAL-WORLD NETWORKS; REALTIME PROCESSING; TEMPORAL BEHAVIOR; WIDE AREA;

SECURITY OF DATA;

SECURITY SYSTEMS;

EID: 84872102390     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2420950.2420969     Document Type: Conference Paper

References (35)

1. Alexa Web Information Company. http://www.alexa.com/topsites/, 2009.
2. EXPOSURE: Exposing Malicious Domains. http://exposure.iseclab.org/, 2011.
3. FIRE: FInding RoguE Networks. http://www.maliciousnetworks.org/, 2011.
4. Google Safe Browsing. http://www.google.com/safebrowsing/diagnostic?site= AS:as-number, 2011.
5. L. Bilge, E. Kirda, C. Kruegel, and M. Balduzzi. Exposure: Finding malicious domains using passive dns analysis. In 18th Annual Network and Distributed System Security Symposium (NDSS'11), 2011.
6. J. Binkley and S. Singh. An Algorithm for Anomaly-based Botnet Detection. In Usenix Steps to Reduce Unwanted Traffic on the Internet (SRUTI), 2006.
7. G. E. P. Box, G. M. Jenkins, and G. Reinsel. Time Series Analysis: Forecasting and Control. In 3rd eddition Upper Saddle River, NJ: PrenticeâǍŞHall, 1994.
8. D. Brauckhoff, X. Dimitropoulos, A. Wagner, and K.Salamatian. Anomaly extraction in backbone networks using association rules. In ACM Internet Measurement Conference (IMC'09), 2009.
9. D. Brauckhoff, B. Tellenbach, A. Wagner, M. May, and A. Lakhina. Impact of packet sampling on anomaly detection metrics. In Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, IMC '06, 2006.
10. B. Claise. Cisco systems netflow services export version 9, 2004.
11. E. Cooke, F. Jahanian, and D. McPherson. The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets. In 1st Workshop on Steps to Reducing Unwanted Traffic on the Internet, pages 39-44, 2005.
12. N. Cristianini and J. Shawe-Taylor. An introduction to support vector machines and other kernel-based learning methods. In Cambridge University Press, 2000.
13. G. Dewaele, K. Fukuda, P. Borgnat, P. Abry, and K. Cho. Extracting hidden anomalies using sketch and non gaussian multiresolution statistical detection procedures. In Proceedings of the 2007 workshop on Large scale attack defense (LSAD'07), 2007.
14. J. Francois, S. Wang, R. State, and T. Engel. Bottrack: Tracking botnets using netflow and pagerank. In IFIP Networking 2011, 2011.
15. F. Freiling, T. Holz, and G. Wicherski. Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks. In 10th European Symposium On Research In Computer Security, 2005.
16. J. Goebel and T. Holz. Rishi: Identify bot contaminated hosts by IRC nickname evaluation. In Workshop on Hot Topics in Understanding Botnets, 2007.
17. G. Gu, R. Perdisci, J. Zhang, and W. Lee. BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection. In Usenix Security Symposium, 2008.
18. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee. BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation. In 16th Usenix Security Symposium, 2007.
19. G. Gu, J. Zhang, and W. Lee. BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic. In 15th Annual Network and Distributed System Security Symposium (NDSS), 2008.
20. J. John, A. Moshchuk, S. Gribble, and A. Krishnamurthy. Studying Spamming Botnets Using Botlab. In 6th Usenix Symposium on Networked Systems Design and Implementation (NSDI), 2009.
21. A. Karasaridis, B. Rexroad, and D. Hoeflin. Wide-scale Botnet Detection and Characterization. In Usenix Workshop on Hot Topics in Understanding Botnets, 2007.
22. D. E. Knuth. Seminumerical algorithms. In The Art of Computer Programming, Volume 2, Addison Wesley, 1969.
23. A. Liaw and M. Wiener. Classification and regression by randomforest. In R News, volume 2/3, page 18, 2002.
24. C. Livadas, R. Walsh, D. Lapsley, and W. T. Strayer. Using machine learning techniques to identify botnet traffic. In the 2nd IEEE LCN Workshop on Network Security (WoNS'2006), 2006.
25. J. Mai, C.-N. Chuah, A. Sridharan, T. Ye, and H. Zang. Is sampled data sufficient for anomaly detection? In Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, IMC '06, 2006.
26. J. Quinlan. C4.5: Programs for machine learning. In Morgan Kaufmann Publishers, 1993.
27. M. A. Rajab, J. Zarfoss, F. Monrose, and A. Terzis. A Multifaceted Approach to Understanding the Botnet Phenomenon. In Internet Measurement Conference (IMC), 2006.
28. A. Ramachandran and N. Feamster. Understanding the network-level behavior of spammers. In SIGCOMM Comput. Commun., 2006.
29. M. Reiter and T. Yen. Traffic aggregation for malware detection. In DIMVA, 2008.
30. A. Sperotto, R. Sadre, and A. Pras. Anomaly characterization in flow-based traffic time series. In Proceedings of the 8th IEEE international workshop on IP Operations and Management, IPOM '08, pages 15-27, 2008.
31. B. Stone-Gross, C. Kruegel, K. Almeroth, A. Moser, and E. Kirda. Fire: Finding rogue networks. In 2009 Annual Computer Security Applications Conference (ACSAC'09), 2009.
32. W. Strayer, R. Walsh, C. Livadas, and D. Lapsley. Detecting Botnets with Tight Command and Control. In 31st IEEE Conference on Local Computer Networks (LCN), 2006.
33. S. Theodoridis and K. Koutroumbas. Pattern Recognition. Academic Press, 2009.
34. A. Wagner and B. Plattner. Entropy based worm and anomaly detection in fast ip networks. In SIG SIDAR Graduierten-Workshop uber Reaktive Sicherheit (SPRING'06), 2006.
35. P. Wurzinger, L. Bilge, T. Holz, J. Goebel, C. Kruegel, and E. Kirda. Automatically generating models for botnet detection. In ESORICS 2009 : 14th European Symposium on Research in Computer Security, 2009.