Machine learning based botnet identification traffic

Azab, Ahmad, Alazab, Mamoun and Aiash, Mahdi ORCID logoORCID: (2016) Machine learning based botnet identification traffic. 2016 IEEE Trustcom/BigDataSE/ISPA. In: 15th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (IEEE TrustCom-2016), 23-26 August 2016, Tianjin, China. ISBN 9781509032051. ISSN 2324-9013 [Conference or Workshop Item] (doi:10.1109/TrustCom.2016.0275)

PDF - Final accepted version (with author's formatting)
Download (245kB) | Preview


The continued growth of the Internet has resulted in the increasing sophistication of toolkit and methods to conduct computer attacks and intrusions that are easy to use and publicly available to download, such as Zeus botnet toolkit. Botnets are responsible for many cyber-attacks, such as spam, distributed denial-of-service (DDoS), identity theft, and phishing. Most of existence botnet toolkits release updates for new features, development and support. This presents challenges in the detection and prevention of bots. Current botnet detection approaches mostly ineffective as botnets change their Command and Control (C&C) server structures, centralized (e.g., IRC, HTTP), distributed (e.g., P2P), and encryption deterrent. In this paper, based on real world data sets we present our preliminary research on predicting the new bots before they launch their attack. We propose a rich set of features of network traffic using Classification of Network Information Flow Analysis (CONIFA) framework to capture regularities in C&C communication channels and malicious traffic. We present a case study of applying the approach to a popular botnet toolkit, Zeus. The experimental evaluation suggest that it is possible to detect effectively botnets during the botnet C&C communication generated from new updated Zeus botnet toolkit by building the classifier using machine learning from an earlier version and before they launch their attacks using traffic behaviors. Also, show that there is similarity in C&C structures various Botnet toolkit versions and that the network characteristics of botnet C&C traffic is different from legitimate network traffic. Such methods could reduce many different resources needed to identify C&C communication channels and malicious traffic.

Item Type: Conference or Workshop Item (Paper)
Additional Information: © 2017 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new
collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
Research Areas: A. > School of Science and Technology > Computer and Communications Engineering
Item ID: 21927
Depositing User: Mahdi Aiash
Date Deposited: 07 Jun 2017 13:59
Last Modified: 29 Nov 2022 21:39

Actions (login required)

View Item View Item


Activity Overview
6 month trend
6 month trend

Additional statistics are available via IRStats2.