Symptoms-based detection of bot processes

Authors:
Jose Andre Morales;Erhan Kartaltepe;Shouhuai Xu;Ravi Sandhu
Affiliations:
Institute for Cyber Security, University of Texas at San Antonio;Institute for Cyber Security, University of Texas at San Antonio;Institute for Cyber Security, University of Texas at San Antonio and Department of Computer Science, University of Texas at San Antonio;Institute for Cyber Security, University of Texas at San Antonio
Venue:
MMM-ACNS'10 Proceedings of the 5th international conference on Mathematical methods, models and architectures for computer network security
Year:
2010

Citing 7
Cited 0

The Art of Computer Virus Research and Defense

The Art of Computer Virus Research and Defense
Computer Viruses: from theory to applications (Collection IRIS)

Computer Viruses: from theory to applications (Collection IRIS)
Data Mining: Practical Machine Learning Tools and Techniques, Second Edition (Morgan Kaufmann Series in Data Management Systems)

Data Mining: Practical Machine Learning Tools and Techniques, Second Edition (Morgan Kaufmann Series in Data Management Systems)
Using uncleanliness to predict future botnet addresses

Proceedings of the 7th ACM SIGCOMM conference on Internet measurement
Rishi: identify bot contaminated hosts by IRC nickname evaluation

HotBots'07 Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets
Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm

LEET'08 Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats
BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection

SS'08 Proceedings of the 17th conference on Security symposium

Quantified Score

Hi-index	0.00

Visualization

Abstract

Botnets have become the most powerful tool for attackers to victimize countless users across cyberspace. Previous work on botnet detection has mainly focused on identifying infected bot computers or IP addresses and not on identifying bot processes on a host machine. This paper aims to fill this gap by presenting a bot process detection technique based on process symptoms such as: TCP connection attempts, DNS activities, digital signatures, unauthorized process tampering, and process hiding. We partition symptoms into sets which are input into classifiers generating individual detection models which are later appropriately integrated so as to improve the detection accuracy. The integrated approach correctly identified two bot processes and did not produced any false positives and false negatives.