Salting public traces with attack traffic to test flow classifiers

  • Authors:

  • Z. Berkay Celik;Jayaram Raghuram;George Kesidis;David J. Miller

  • Affiliations:

  • Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA;Department of Electrical Engineering, Pennsylvania State University, University Park, PA;Department of Computer Science and Engineering, Pennsylvania State University, University Park, PA and Department of Electrical Engineering, Pennsylvania State University, University Park, PA;Department of Electrical Engineering, Pennsylvania State University, University Park, PA

  • Venue:
  • CSET'11 Proceedings of the 4th conference on Cyber security experimentation and test
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

We consider the problem of using flow-level data for detection of botnet command and control (C&C) activity. We find that current approaches do not consider timing-based calibration of the C&C traffic traces prior to using this traffic to salt a background traffic trace. Thus, timing-based features of the C&C traffic may be artificially distinctive, potentially leading to (unrealistically) optimistic flow classification results. In this paper, we show that round-trip times (RTT) of the C&C traffic are significantly smaller than that of the background traffic. We present a method to calibrate the timing-based features of the simulated botnet traffic by estimating eligible RTT samples from the background traffic. We then salt C&C traffic, and design flow classifiers under four scenarios: with and without calibrating timing-based features of C&C traffic, without using timing-based features, and calibrating C&C traffic only in the test set. In the flow classifier, we strive to use features that are not readily susceptible to obfuscation or tampering such as port numbers or protocol-specific information in the payload header. We discuss the results for several supervised classifiers, evaluating botnet C&C traffic precision, recall, and overall classification accuracy. Our experiments reveal to what extent the presence of timing artifacts in botnet traces leads to changes in classifier results.