BotMosaic: Collaborative network watermark for the detection of IRC-based botnets

Journal of Systems and Software

Volumn 86, Issue 3, 2013, Pages 707-715

  Houmansadr, Amir ^a   Borisov, Nikita ^b  

^a UNIVERSITY OF TEXAS AT AUSTIN   (United States)

^b United States of America   (United States)

Author keywords

Botmaster traceback; Botnet detection; Network flow watermarking; Network security; Traffic analysis

Indexed keywords

BOTNETS; CLIENT ORGANIZATIONS; COLLABORATIVE NETWORK; ENCRYPTED TRAFFIC; LOW COSTS; NETWORK FLOWS; NETWORK TRAFFIC; STEPPING STONE; TRACEBACK; TRAFFIC ANALYSIS;

INTERNET SERVICE PROVIDERS; NETWORK SECURITY; SOCIETIES AND INSTITUTIONS;

WATERMARKING;

EID: 84872680683     PISSN: 01641212     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.jss.2012.11.005     Document Type: Article

References (34)

1. Bavier, A.; Bowman, M.; Chun, B.; Culler, D.; Karlin, S.; Muir, S.; Peterson, L.; Roscoe, T.; Spalink, T.; Wawrzoniak, M.; 2004. Operating Systems Support for Planetary-Scale Network Services, USENIX Symposium on Networked Systems Design and Implementation (NSDI), pp. 253-266.
2. S. Bhattacharya, and A. Cortesi A distortion free watermark framework for relational databases B. Shishkov, J. Cordeiro, A. Ranchordas, ICSOFT (2) 2009 INSTICC Press Sofia, Bulgaria 229 234
3. S. Bhattacharya, and A. Cortesi A generic distortion free watermarking technique for relational databases A. Prakash, I. Gupta, ICISS. Vol. 5905 of Lecture Notes in Computer Science 2009 Springer Kolkata, India 252 264 10.1007/978-3-642-10772-6
4. J.R. Binkley, and S. Singh An algorithm for anomaly-based botnet detection. SRUTI '06: Proceedings of the 2nd Conference on Steps to Reducing Unwanted Traffic on the Internet USENIX Association, Berkeley, CA, USA 2006 7
5. M.P. Collins, T.J. Shimeall, S. Faber, J. Janies, R. Weaver, M. De Shon, and J. Kadane Using uncleanliness to predict future botnet addresses IMC '07: Proceedings of the 7th ACM SIGCOMM Conference on Internet measurement ACM, New York, NY, USA 2007 93 104
6. J. Goebel, and T. Holz Rishi: identify bot contaminated hosts by IRC nickname evaluation Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets (HotBots'07) USENIX Association, Berkeley, CA, USA 2007 8-8
7. G. Gu, J. Zhang, and W. Lee BotSniffer: detecting botnet command and control channels in network traffic Proceedings of the 15th Annual Network and Distributed System Security Symposium (NDSS'08) 2008
8. A. Houmansadr, and N. Borisov SWIRL: a scalable watermark to detect correlated network flows Proceedings of the Network and Distributed System Security Symposium, NDSS' 2011 11
9. A. Houmansadr, N. Kiyavash, and N. Borisov Multi-flow attack resistant watermarks for network flows IEEE International Conference on Acoustics, Speech and Signal Processing. 2009 1497 1500
10. A. Houmansadr, N. Kiyavash, and N. Borisov Rainbow: a robust and invisible non-blind watermark for network flows NDSS 2009
11. Kalt, C.; 2000. Internet Relay Chat: Server Protocol. RFC 2813 (Informational). http://www.ietf.org/rfc/rfc2813.txt.
12. I. Kamel, O. AlKoky, and A.A.A. Dakkak Distortion-free watermarking scheme for wireless sensor networks Y. Badr, S. Caballé, F. Xhafa, A. Abraham, B. Gros, INCoS. IEEE 2009 135 140 http://ieeexplore.ieee.org/xpl/ mostRecentIssue.jsp?punumber=5367992
13. A. Karasaridis, B. Rexroad, and D. Hoeflin Wide-scale botnet detection and characterization N. Provos, First Workshop on Hot Topics in Understanding Botnets (HotBots) 2007
14. Kharouni, L.; 2009. SDBOT IRC botnet continues to make waves. White paper, Trend Micro Threat Research.
15. N. Kiyavash, A. Houmansadr, and N. Borisov Multi-flow attacks against network flow watermarking schemes P. van Oorschot, USENIX Security Symposium 2008 USENIX Association, Berkeley CA, USA
16. P.Y. Lin, J.S. Lee, and C.C. Chang Distortion-free secret image sharing mechanism using modulus operator Pattern Recognition 42 May (5) 2009 886 895 10.1016/j.patcog.2008.09.014
17. S. Nagaraja, A. Houmansadr, P. Agarwal, V. Kumar, P. Piyawongwisal, and N. Borisov Stegobot: a covert social network botnet. A. Ker, S. Kraver, T. Filler, 13th Information Hiding Conference (IH). Lecture Notes in Computer Science 2011 Springer Berlin, Heidelberg
18. Oikarinen, J.; Reed, D.; 1993. RFC 1459: Internet Relay Chat Protocol. Status: EXPERIMENTAL. ftp://ftp.internic.net/rfc/rfc1459.txt, ftp://ftp.math.utah.edu/pub/rfc/rfc1459.txt.
19. N. Provos A virtual honeypot framework SSYM'04: Proceedings of the 13th Conference on USENIX Security Symposium USENIX Association, Berkeley, CA, USA 2004
20. Y. Pyun, Y. Park, X. Wang, D.S. Reeves, and P. Ning Tracing traffic through intermediate hosts that repacketize flows. G. Kesidis, E. Modiano, R. Srikant, IEEE Conference on Computer Communications (INFOCOM). 2007 634 642 (Pubitemid 47334280)
21. A. Ramachandran, and N. Feamster Understanding the network-level behavior of spammers L. Rizzo, T.E. Anderson, N. McKeown, SIGCOMM 2006 ACM 291 302 (Pubitemid 44623735)
22. A. Ramachandran, N. Feamster, and D. Dagon Revealing botnet membership using dnsbl counter-intelligence. SRUTI'06: Proceedings of the 2nd Conference on Steps to Reducing Unwanted Traffic on the Internet USENIX Association, Berkeley, CA, USA 2006 8
23. D. Ramsbrock, X. Wang, and X. Jiang A first step towards live botmaster traceback R. Lippmann, E. Kirda, A. Trachtenberg, RAID. Vol. 5230 of Lecture Notes in Computer Science 2008 Springer 59 77
24. L. Spitzner The Honeynet Project: trapping the hackers IEEE Security & Privacy Magazine 1 2 2003 15 23
25. G. Ulutas, M. Ulutas, and V.V. Nabiyev Distortion free geometry based secret image sharing Procedia CS 3 2011 721 726 10.1016/j.procs.2010.12.119
26. R. Villamarín-Salomón, and J.C. Brustoloni Bayesian bot detection based on dns traffic similarity. In: SAC '09: Proceedings of the 2009 ACM Symposium on Applied Computing ACM, New York, NY, USA 2009 2035 2041
27. X. Wang, S. Chen, and S. Jajodia Tracking anonymous peer-to-peer VoIP calls on the Internet. C. Meadows, ACM Conference on Computer and Communications Security 2005 Nov ACM New York, NY, USA 81 91 (Pubitemid 44021992)
28. X. Wang, S. Chen, and S. Jajodia Network flow watermarking attack on low-latency anonymous communication systems B. Pfitzmann, P. McDaniel, IEEE Symposium on Security and Privacy 2007 116 130 (Pubitemid 47432521)
29. X. Wang, D. Reeves, and S.F. Wu Inter-packet delay based correlation for tracing encrypted connections through stepping stones. D. Gollmann, G. Karjoth, M. Waidner, European Symposium on Research in Computer Security. Vol. 2502 of Lecture Notes in Computer Science 2002 Springer 244 263
30. X. Wang, and D.S. Reeves Robust correlation of encrypted attack traffic through stepping stones by manipulation of interpacket delays V. Atluri, ACM Conference on Computer and Communications Security 2003 ACM New York, NY, USA 20 29 (Pubitemid 40673785)
31. W. Yu, X. Fu, S. Graham, D. Xuan, and W. Zhao DSSS-based flow marking technique for invisible traceback B. Pfitzmann, P. McDaniel, IEEE Symposium on Security and Privacy 2007 18 32 (Pubitemid 47432513)
32. Y. Zhang, and V. Paxson Detecting stepping stones. S. Bellovin, G. Rose, USENIX Security Symposium 2000 USENIX Association Berkeley, CA, USA 171 184
33. Zhuge, J.; Holz, T.; Han, X.; Guo, J.; Zou, W.; 2007. Characterizing the IRC-based botnet phenomenon. Tech. Rep. TR-2007-010, Department for Mathematics and Computer Science, University of Mannheim.
34. W. Zilong, W. Jinsong, H. Wenyi, and X. Chengyi The detection of IRC botnet based on abnormal behavior In: Second International Conference on Multimedia and Information Technology (MMIT), vol. 2 2010 April 146 149