BotCloud: Detecting botnets using MapReduce

Authors:
Jerome Francois;Shaonan Wang;Walter Bronzi;Radu State;Thomas Engel
Affiliations:
University of Luxembourg - Interdisciplinary Center for Security, Reliability and Trust, 6 rue R. Coudenhove-Kalergi, L-1359, Luxembourg;University of Luxembourg - Interdisciplinary Center for Security, Reliability and Trust, 6 rue R. Coudenhove-Kalergi, L-1359, Luxembourg;University of Luxembourg - Interdisciplinary Center for Security, Reliability and Trust, 6 rue R. Coudenhove-Kalergi, L-1359, Luxembourg;University of Luxembourg - Interdisciplinary Center for Security, Reliability and Trust, 6 rue R. Coudenhove-Kalergi, L-1359, Luxembourg;University of Luxembourg - Interdisciplinary Center for Security, Reliability and Trust, 6 rue R. Coudenhove-Kalergi, L-1359, Luxembourg
Venue:
WIFS '11 Proceedings of the 2011 IEEE International Workshop on Information Forensics and Security
Year:
2011

Citing 0
Cited 2

Efficient multidimensional aggregation for large scale monitoring

lisa'12 Proceedings of the 26th international conference on Large Installation System Administration: strategies, tools, and techniques
Review: A survey of network flow applications

Journal of Network and Computer Applications

Quantified Score

Hi-index	0.00

Visualization

Abstract

Botnets are a major threat of the current Internet. Understanding the novel generation of botnets relying on peer-to-peer networks is crucial for mitigating this threat. Nowadays, botnet traffic is mixed with a huge volume of benign traffic due to almost ubiquitous high speed networks. Such networks can be monitored using IP flow records but their forensic analysis form the major computational bottleneck. We propose in this paper a distributed computing framework that leverages a host dependency model and an adapted PageRank [1] algorithm. We report experimental results from an open-source based Hadoop cluster [2] and highlight the performance benefits when using real network traces from an Internet operator.