Detection and classification of different botnet C&C channels

Authors:
Gregory Fedynyshyn;Mooi Choo Chuah;Gang Tan
Affiliations:
Lehigh University, Bethlehem, PA;-;-
Venue:
ATC'11 Proceedings of the 8th international conference on Autonomic and trusted computing
Year:
2011

Citing 5
Cited 0

Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm

LEET'08 Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats
BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection

SS'08 Proceedings of the 17th conference on Security symposium
Studying spamming botnets using Botlab

NSDI'09 Proceedings of the 6th USENIX symposium on Networked systems design and implementation
Exploiting Temporal Persistence to Detect Covert Botnet Channels

RAID '09 Proceedings of the 12th International Symposium on Recent Advances in Intrusion Detection
Automatically generating models for botnet detection

ESORICS'09 Proceedings of the 14th European conference on Research in computer security

Quantified Score

Hi-index	0.00

Visualization

Abstract

Unlike other types of malware, botnets are characterized by their command and control (C&C) channels, through which a central authority, the botmaster, may use the infected computer to carry out malicious activities. Given the damage botnets are capable of causing, detection and mitigation of botnet threats are imperative. In this paper, we present a host-based method for detecting and differentiating different types of botnet infections based on their C&C styles, e.g., IRCbased, HTTP-based, or peer-to-peer (P2P) based. Our ability to detect and classify botnet C&C channels shows that there is an inherent similarity in C&C structures for different types of bots and that the network characteristics of botnet C&C traffic is inherently different from legitimate network traffic. The best performance of our detection system has an overall accuracy of 0.929 and a false positive rate of 0.078.