BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic

Proceedings of the Symposium on Network and Distributed System Security, NDSS 2008

Volumn , Issue , 2008, Pages

  Gu, Guofei ^a   Zhang, Junjie ^a   Lee, Wenke ^a  

^a Georgia Institute of Technology   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ANOMALY DETECTION; C (PROGRAMMING LANGUAGE); HTTP; HYPERTEXT SYSTEMS; MALWARE; NETWORK SECURITY;

ANOMALY DETECTION; BOTNETS; COMMAND AND CONTROL; CONTROL CHANNELS; IN NETWORKS; MALWARES; NETWORK TRAFFIC; NETWORK-BASED; SECURITY THREATS; SPATIAL-TEMPORAL CORRELATION;

BOTNET;

EID: 85175133385     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (31)

1. Hi-performance protocol identification engine. http://hippie.oofle.com/, 2007.
2. Quick analysis of a proxy/zombie network. http:// lowkeysoft.com/proxy/client.php, 2007.
3. P. Baecher, M. Koetter, T. Holz, M. Dornseif, and F. Freiling. The nepenthes platform: An efficient approach to collect malware. In Proceedings of Recent Advances in Intrusion Detection, Hamburg, September 2006.
4. M. Bailey, J. Oberheide, J. Andersen, M. Mao, F. Jahanian, and J. Nazario. Automated classification and analysis of internetmalware. In Proceedings of Recent Advances in Intrusion Detection (RAID’07), 2007.
5. P. Barford and V. Yegneswaran. An Inside Look at Botnets. Special Workshop on Malware Detection, Advances in Information Security, Springer Verlag, 2006.
6. J. R. Binkley and S. Singh. An algorithmfor anomalybased botnet detection. In Proceedings of USENIX Steps to Reducing Unwanted Traffic on the Internet Workshop (SRUTI), pages 43-48, July 2006.
7. C. Brew and D. McKelvie. Word-pair extraction for lexicography, 1996.
8. M. Collins, T. Shimeall, S. Faber, J. Janies, R.Weaver, M. D. Shon, and J. Kadane. Using uncleanliness to predict future botnet addresses,. In Proceedings of the 2007 Internet MeasurementConference (IMC’07), 2007.
9. E. Cooke, F. Jahanian, and D.McPherson. The zombie roundup: Understanding, detecting, and disrupting botnets. In Proceedings of Workshop on Steps to Re- ducing Unwanted Traffic on the Internet (SRUTI’05), 2005.
10. D. Dagon, C. Zou, and W. Lee. Modeling botnet propagation using timezones. In Proceedings of Network and Distributed Security Symposium (NDSS '06), January 2006.
11. N. Daswani and M. Stoppelman. The anatomy of clickbot.a. In USENIX Hotbots’07, 2007.
12. M. H. Degroot and M. J. Schervish. Probability and Statistics. Addison-Wesley, 2002.
13. J. Goebel and T. Holz. Rishi: Identify bot contaminated hosts by irc nickname evaluation. In USENIX Workshop on Hot Topics in Understanding Botnets (HotBots’07), 2007.
14. J. B. Grizzard, V. Sharma, C. Nunnery, B. B. Kang, and D. Dagon. Peer-to-peer botnets: Overview and case study. In USENIX Workshop on Hot Topics in Understanding Botnets (HotBots’07), 2007.
15. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee. Bothunter: Detecting malware infection through ids-driven dialog correlation. In 16th USENIX Security Symposium (Security’07), 2007.
16. N. Ianelli and A. Hackworth. Botnets as a vehicle for online crime. http://www.cert.org/ archive/pdf/Botnets.pdf, 2005.
17. J. Jung, V. Paxson, A.W. Berger, and H. Balakrishnan. Fast Portscan Detection Using Sequential Hypothesis Testing. In IEEE Symposium on Security and Privacy 2004, Oakland, CA, May 2004.
18. A. Karasaridis, B. Rexroad, and D. Hoeflin. Widescale botnet detection and characterization. In USENIX Hotbots’07, 2007.
19. R. Lemos. Bot software looks to improve peerage. Http://www.securityfocus.com/ news/11390, 2006.
20. C. Livadas, R. Walsh, D. Lapsley, and W. T. Strayer. Using machine learning techniques to identify botnet traffic. In 2nd IEEE LCN Workshop on Network Security (WoNS’2006), 2006.
21. M. Priestley. Spectral analysis and time series. Academic Press, 1982.
22. M. Rajab, J. Zarfoss, F. Monrose, and A. Terzis. A multi-faceted approach to understanding the botnet phenomenon. In Proceedings of ACM SIG-COMM/USENIX Internet Measurement Conference, Brazil, October 2006.
23. A. Ramachandran, N. Feamster, and S. Vempala. Filtering spam with behavioral blacklisting. In Proc. ACM Conference on Computer and Communications Security (CCS’07), 2007.
24. M. Roesch. Snort - lightweight intrusion detection for networks. In Proceedings of USENIX LISA’99, 1999.
25. J. Stewart. Bobax trojan analysis. http: //www.secureworks.com/research/ threats/bobax/, 2004.
26. W. T. Strayer, R. Walsh, C. Livadas, and D. Lapsley. Detecting botnets with tight command and control. In 31st IEEE Conference on Local Computer Networks (LCN’06), 2006.
27. A. Wald. Sequential Analysis. Dover Publications, 2004.
28. S. Wehner. Analyzing worms and network traffic using compression. Journal of Computer Security, 15(3):303-320, 2007.
29. M. Xie, H. Yin, and H. Wang. An effective defense against email spam laundering. In ACMComputer and Communications Security (CCS’06), 2006.
30. V. Yegneswaran, P. Barford, and V. Paxson. Using honeynets for internet situational awareness. In Pro- ceedings of the Fourth Workshop on Hot Topics in Networks (HotNets IV), College Park, MD, November 2005.
31. J. Zhuge, T. Holz, X. Han, J. Guo, and W. Zou. Characterizing the irc-based botnet phenomenon. Peking University & University of Mannheim Technical Report, 2007.