Botnet detection based on non-negative matrix factorization and the MDL principle

Authors:
Sayaka Yamauchi;Masanori Kawakita;Jun'ichi Takeuchi
Affiliations:
Institute of Systems, Information Technologies and Nanotechnologies (ISIT), Japan,Graduate School of ISEE, Kyushu University, Japan;Institute of Systems, Information Technologies and Nanotechnologies (ISIT), Japan,Graduate School of ISEE, Kyushu University, Japan;Institute of Systems, Information Technologies and Nanotechnologies (ISIT), Japan,Graduate School of ISEE, Kyushu University, Japan
Venue:
ICONIP'12 Proceedings of the 19th international conference on Neural Information Processing - Volume Part V
Year:
2012

Citing 5
Cited 0

A Unifying Framework for Detecting Outliers and Change Points from Time Series

IEEE Transactions on Knowledge and Data Engineering
A Proposal of Metrics for Botnet Detection Based on Its Cooperative Behavior

SAINT-W '07 Proceedings of the 2007 International Symposium on Applications and the Internet Workshops
An incident analysis system NICTER and its analysis engines based on data mining techniques

ICONIP'08 Proceedings of the 15th international conference on Advances in neuro-information processing - Volume Part I
Paper: Modeling by shortest data description

Automatica (Journal of IFAC)
Fisher information and stochastic complexity

IEEE Transactions on Information Theory

Quantified Score

Hi-index	0.00

Visualization

Abstract

We propose a method for botnet detection from darknet data by non-negative matrix factorization (NMF), which can decompose the vector valued time series data into several components. In addition, we propose a new method to estimate the number of components in the data, by the minimum description length (MDL) principle. Our method for botnet detection consists of change point detection and analysis based on variance of the decomposed data.