Towards automated detection of peer-to-peer botnets: On the limits of local approaches

LEET 2009 - 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats: Botnets, Spyware, Worms, and More

Volumn , Issue , 2009, Pages

  Jelasity, Márk ^a   Bilicki, Vilmos ^a  

^a UNIVERSITY OF SZEGED   (Hungary)

Author keywords

[No Author keywords available]

Indexed keywords

AUTOMATION; BOTNET; COMPUTER VIRUSES;

AUTOMATED DETECTION; EXPERIMENTAL ANALYSIS; LABOR INTENSIVE PROCESS; LOCAL APPROACHES; LOCAL MONITORING; SEARCH TRAFFICS; STATE OF THE ART; STATE-OF-THE-ART APPROACH;

PEER TO PEER NETWORKS;

EID: 85084094913     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (27)

1. CHEETANCHERI, S. G., AGOSTA, J. M., DASH, D. H., LEVITT, K. N., ROWE, J., AND SCHOOLER, E. M. A distributed host-based worm detection system. In Proceedings of the 2006 SIGCOMM workshop on Large-scale attack defense (LSAD’06) (New York, NY, USA, 2006), ACM, pp. 107–113.
2. DAGON, D. Botnet detection and response: The network is the infection, 2005. OARC Workshop presentation.
3. GRIZZARD, J., SHARMA, V., NUNNERY, C., KANG, B., AND DAGON, D. Peer-to-peer botnets: Overview and case study. In Proceedings of the First USENIX Workshop on Hot Topics in Understanding Botnets (HotBots’07) (2007).
4. GU, G., PERDISCI, R., ZHANG, J., AND LEE, W. BotMiner: Clustering analysis of network traffic for protocol- and structure-independent botnet detection. In Proceedings of the 17th USENIX Security Symposium (Security’08) (2008).
5. HOLZ, T., STEINER, M., DAHL, F., BIERSACK, E., AND FREILING, F. Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm. In Proceedings of the 1st USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET’08) (Berkeley, CA, USA, 2008), USENIX Association.
6. HYUN, Y., HUFFAKER, B., ANDERSEN, D., ABEN, E., LUCKIE, M., K CLAFFY, AND SHANNON, C. The IPv4 Routed /24 AS Links Dataset – 2008-01-02. http://www.caida.org/data/active/ipv4_routed_topology_aslinks_dataset.xml.
7. ILIOFOTOU, M., PAPPU, P., FALOUTSOS, M., MITZENMACHER, M., SINGH, S., AND VARGHESE, G. Network monitoring using traffic dispersion graphs (TDGs). In Proceedings of the 7th ACM SIGCOMM conference on Internet measurement (IMC’07) (New York, NY, USA, 2007), ACM, pp. 315–320.
8. ILIOFOTOU, M., PAPPU, P., FALOUTSOS, M., MITZENMACHER, M., VARGHESE, G., AND KIM, H. Graption: Automated detection of P2P applications using traffic dispersion graphs (TDGs). Tech. Rep. UCR-CS-2008-06080, Department of Computer Science and Engineering, University of California, Riverside, June 2008.
9. JELASITY, M., AND BABAOGLU, O. T-Man: Gossip-based overlay topology management. In Engineering Self-Organising Systems: Third International Workshop (ESOA 2005), Revised Selected Papers (2006), S. A. Brueckner, G. Di Marzo Serugendo, D. Hales, and F. Zambonelli, Eds., vol. 3910 of Lecture Notes in Computer Science, Springer-Verlag, pp. 1–15.
10. JELASITY, M., VOULGARIS, S., GUERRAOUI, R., KERMARREC, A.-M., AND VAN STEEN, M. Gossip-based peer sampling. ACM Transactions on Computer Systems 25, 3 (Aug. 2007), 8.
11. JOHNSON, D. S., AND MCGEOCH, L. A. The traveling salesman problem: A case study in local optimization. In Local Search in Combinatorial Optimization, E. H. L. Aarts and J. K. Lenstra, Eds. John Wiley and Sons, 1997, pp. 215–310.
12. KANICH, C., LEVCHENKO, K., ENRIGHT, B., VOELKER, G. M., AND SAVAGE, S. The heisenbot uncertainty problem: Challenges in separating bots from chaff. In Proceedings of the 1st USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET’08) (Berkeley, CA, USA, 2008), USENIX Association.
13. KERMARREC, A.-M., AND VAN STEEN, M., Eds. ACM SIGOPS Operating Systems Review 41. Oct. 2007. Special issue on Gossip-Based Networking.
14. KLEINBERG, J. Navigation in a small world. Nature 406 (2000), 845.
15. KLEINBERG, J. The wireless epidemic. Nature 449 (2007), 287–288. News and Views.
16. LUA, E. K., CROWCROFT, J., PIAS, M., SHARMA, R., AND LIM, S. A survey and comparison of peer-to-peer overlay network schemes. IEEE Communications Surveys and Tutorials 7, 2 (2005), 72–93.
17. MAHADEVAN, P., KRIOUKOV, D., FOMENKOV, M., DIMITROPOULOS, X., K C CLAFFY, AND VAHDAT, A. The Internet AS-level topology: three data sources and one definitive metric. SIGCOMM Comput. Commun. Rev. 36, 1 (2006), 17–26.
18. MALKHI, D., NAOR, M., AND RATAJCZAK, D. Viceroy: A scalable and dynamic emulation of the butterfly. In Proceedings of the 21st ACM Symposium on Principles of Distributed Computing (PODC’02) (2002).
19. MANKU, G. S., BAWA, M., AND RAGHAVAN, P. Symphony: Distributed hashing in a small world. In Proceedings of the 4th USENIX Symposium on Internet Technologies and Systems (USITS’03) (2003).
20. MASSOULIÉ, L., KERMARREC, A.-M., AND GANESH, A. J. Network awareness and failure resilience in self-organising overlay networks. In Proceedings of the 22nd Symposium on Reliable Distributed Systems (SRDS 2003) (Florence, Italy, 2003), pp. 47–55.
21. MONTRESOR, A. A robust protocol for building superpeer overlay topologies. In Proceedings of the 4th IEEE International Conference on Peer-to-Peer Computing (P2P’04) (Zurich, Switzerland, Aug. 2004), IEEE Computer Society, pp. 202–209.
22. NGUYEN, T. T. T., AND ARMITAGE, G. A survey of techniques for Internet traffic classification using machine learning. IEEE Communications Surveys and Tutorials 10, 4 (2008), 56–76.
23. RAMACHANDRAN, A., FEAMSTER, N., AND DAGON, D. Revealing botnet membership using DNSBL counter-intelligence. In Proceedings of the 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI’06) (2006).
24. RIPEANU, M., IAMNITCHI, A., AND FOSTER, I. Mapping the gnutella network. IEEE Internet Computing 6, 1 (2002), 50–57.
25. STOICA, I., MORRIS, R., KARGER, D., KAASHOEK, M. F., AND BALAKRISHNAN, H. Chord: A scalable peer-to-peer lookup service for Internet applications. In Proceedings of the 2001 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM) (San Diego, CA, 2001), ACM, ACM Press, pp. 149–160.
26. STRAYER, W. T., LAPSELY, D., WALSH, R., AND LIVADAS, C. Botnet detection based on network behavior. In Botnet Detection: Countering the Largest Security Threat, W. Lee, C. Wang, and D. Dagon, Eds., vol. 36 of Advances in Information Security. Springer, 2008, pp. 1–24.
27. WEAVER, N., ELLIS, D., STANIFORD, S., AND PAXSON, V. Worms vs. perimeters: the case for hard-LANs. In Proceedings of the 12th Annual IEEE Symposium on High Performance Interconnects (HOTI’04) (Washington, DC, USA, 2004), IEEE Computer Society, pp. 70–76.