Usilng Machine Learning Technliques to Identify Botnet Traffic

IRJET, 2020

The growth of internet of things leads to rise of botnet attacks. Botnet are the group of computers which connected to each other to perform n number of respective tasks to process the website to keep on working. One of the most powerful ways to pursue any computationally challenging task is to leverage the untapped processing power of a very large number of everyday end points. The idea behind the botnet is a collection of workstations and servers are distributed over the public internet, this leads to the agenda of malicious or criminal entity. The foremost target of the botnet to attack as possible as many devices along with spreading most optimistic through malicious code. The botnet attacks together with infect all kind of technology, rudimentary of internet security suites, firewall including antivirus dispense some protection. In advance we proposed dynamic analysis, looking up for sign of infection in behavioral analysis along with network and picking up unusual network traffic. The attack on botnet symptoms on individual with network levels. In this paper, performance of network dataset has been compared to predict the accuracy and anomalies on the network. The machine learning algorithms which have been used here is Logistic Regression (LR). Our experiments shows, that our approach can compare benign traffic and the junk traffic effectively and reaches the accuracy of 99.98%.

—The biggest internet security threat is the rise of Botnets having modular and flexible structures. The combined power of thousands of remotely controlled computers increases the speed and severity of attacks. In this paper, we provide a comparative analysis of machine-learning based classification of botnet command & control traffic for proactive detection of Peer-to-Peer (P2P) botnets. Our simulation results shows that our method is very effective having very good test accuracy and very little training time. We compare the performances of Decision Tree (C4.5), Bayesian Network and Linear Support Vector Machines using performance metrics like accuracy, sensitivity, positive predictive value(PPV) and F-Measure. We also provide a comparative analysis of the machine learning algorithms using AUC(area under ROC curve). Our results shows that machine learning algorithms produces very promising results in identifying suspicious P2P bot flows.

Botnets are the technological backbone supporting myriad of attacks, including identity stealing, organizational spying, DoS, SPAM, government-sponsored attacks and spying of political dissidents among others. The research community works hard creating detection algorithms of botnet network traffic. These algorithms have been partially successful, but are difficult to reproduce and verify; being often commercialized. However, the advances in machine learning algorithms and the access to better botnet datasets start showing promising results. The shift of the detection techniques to behavioral-based models has proved to be a better approach to the analysis of botnet patterns. However, the current knowledge of the botnet actions and patterns does not seem to be deep enough to create adequate traffic models that could be used to detect botnets in real networks. This thesis proposes three new botnet detection methods and a new model of botnet behavior that are based in a deep understand...

Computers & Security, 2010

Traffic analysis Machine learning IT security a b s t r a c t We develop and discuss automated and self-adaptive systems for detecting and classifying botnets based on machine learning techniques and integration of human expertise. The proposed concept is purely passive and is based on analyzing information collected at three levels: (i) the payload of single packets received, (ii) observed access patterns to a darknet at the level of network traffic, and (iii) observed contents of TCP/IP traffic at the protocol level.

Botnets are now recognized as one of the most serious security threats. In contrast to previous malware, botnets have the characteristic of a command and control (C&C) channel. Botnets also often use existing common protocols, e.g., IRC, HTTP, and in protocol-conforming manners. This makes the detection of botnet C&C a challenging problem. In this paper, we propose an approach that uses network-based anomaly detection to identify botnet C&C channels in a local area network without any prior knowledge of signatures or C&C server addresses. This detection approach can identify both the C&C servers and infected hosts in the network. Our approach is based on the observation that, because of the pre-programmed activities related to C&C, bots within the same botnet will likely demonstrate spatial-temporal correlation and similarity. For example, they engage in coordinated communication, propagation, and attack and fraudulent activities. Our prototype system, BotSniffer, can capture this spatial-temporal correlation in network traffic and utilize statistical algorithms to detect botnets with theoretical bounds on the false positive and false negative rates. We evaluated BotSniffer using many real-world network traces. The results show that BotSniffer can detect real-world botnets with high accuracy and has a very low false positive rate.

Botnet are becoming the most significant threat to the internet world. Botnet is the automated process of attackers that interacts with network traffic and its services. Botnet are automatically updated into the compromised system to collect the authenticated information. In this paper, we present a model to extract some features which are helpful to analyze the behaviour of bot members present in the particular network traffic. On the other hand, various superior methods are evaluated to extract weather network traffic contain bot or not. In particularly, our evaluation shows that the particular traffic contain any bot member in their communication.

2020 14th International Conference on Innovations in Information Technology (IIT), 2020

With the advancement of computers and technology, security threats are also evolving at a fast pace. Botnets are one such security threat which requires a high level of research and focus in order to be eliminated. In this paper, we use machine learning to detect Botnet attacks. Using the Bot-IoT and University of New South Wales (UNSW) datasets, four machine learning models based on four classifiers are built: Naïve Bayes, K-Nearest Neighbor, Support Vector Machine, and Decision Trees. Using 82,000 records from UNSW-NB15 dataset, the decision trees model has yielded the best overall results with 99.89% testing accuracy, 100% precision, 100% recall, and 100% F-score in detecting botnet attacks.

CLEI Electronic Journal, 2013

The possibilities that the management of a vast amount of computers and/or networks offer is attracting an increasing number of malware writers. In this document, the authors propose a methodology thought to detect malicious botnet traffic, based on the analysis of the packets that flow within the network. This objective is achieved by means of the extraction of the static characteristics of packets, which are lately analysed using supervised machine learning techniques focused on traffic labelling so as to proactively face the huge volume of information nowadays filters work with.

2008

Botnets are now the key platform for many Internet attacks, such as spam, distributed denial-of-service (DDoS), identity theft, and phishing. Most of the current botnet detection approaches work only on specific botnet command and control (C&C) protocols (e.g., IRC) and structures (e.g., centralized), and can become ineffective as botnets change their C&C techniques. In this paper, we present a general detection framework that is independent of botnet C&C protocol and structure, and requires no a priori knowledge of botnets (such as captured bot binaries and hence the botnet signatures, and C&C server names/addresses). We start from the definition and essential properties of botnets. We define a botnet as a coordinated group of malware instances that are controlled via C&C communication channels. The essential properties of a botnet are that the bots communicate with some C&C servers/peers, perform malicious activities, and do so in a similar or correlated way. Accordingly, our detection framework clusters similar communication traffic and similar malicious traffic, and performs cross cluster correlation to identify the hosts that share both similar communication patterns and similar malicious activity patterns. These hosts are thus bots in the monitored network. We have implemented our BotMiner prototype system and evaluated it using many real network traces. The results show that it can detect real-world botnets (IRC-based, HTTP-based, and P2P botnets including Nugache and Storm worm), and has a very low false positive rate.

Proceedings. 2006 31st IEEE Conference on Local Computer Networks, 2006

Systems are attempting to detect botnets by examining traffic content for IRC commands or by setting up honeynets. Our approach for detecting botnets is to examine flow characteristics such as bandwidth, duration, and packet timing looking for evidence of botnet command and control activity. We have constructed an architecture that first eliminates traffic that is unlikely to be a part of a botnet, classifies the remaining traffic into a group that is likely to be part of a botnet, then correlates the likely traffic to find common communications patterns that would suggest the activity of a botnet. Our results show that botnet evidence can be extracted from a traffic trace containing almost 9 million flows.

Botnets are known to be one of the most serious threats to the security of the Internet and the future of cyberspace. To fight against the formidable force of these cyber-criminal tools, numerous research works appeared in the literature that studied detection of Botnets. One of the most promising approaches is network-based detection using machinelearning tools. These methods can possibly provide detection of new unobserved bots. Most of these methods conventionally use features directly extracted from network flows to detect infected nodes. In our study, we propose the utilization of features that are extracted from a set of network flows in a fixed-length time interval. We argue that such features could better model the behavior of a botnet, thus, providing higher detection rates and lower false alarms. Also in the study, the significant potential of our method in bot detection is demonstrated by providing results of multiple experiments and comparisons with similar methods.

Journal of Electrical and Computer Engineering, 2022

Today, botnets are the most common threat on the Internet and are used as the main attack vector against individuals and businesses. Cybercriminals have exploited botnets for many illegal activities, including click fraud, DDOS attacks, and spam production. In this article, we suggest a method for identifying the behavior of data trafc using machine learning classifers including genetic algorithm to detect botnet activities. By categorizing behavior based on time slots, we investigate the viability of detecting botnet behavior without seeing a whole network data fow. We also evaluate the efcacy of two well-known classifcation methods with reference to this data. We demonstrate experimentally, using existing datasets, that it is possible to detect botnet activities with high precision.

Advances in Information Security, 2008

Current techniques for detecting botnets examine traffic content for IRC commands, monitor DNS for strange usage, or set up honeynets to capture live bots. Our botnet detection approach is to examine flow characteristics such as bandwidth, packet timing, and burst duration for evidence of botnet command and control activity. We have constructed an architecture that first eliminates traffic that is unlikely to be a part of a botnet, classifies the remaining traffic into a group that is likely to be part of a botnet, then correlates the likely traffic to find common communications patterns that would suggest the activity of a botnet. Our results show that botnet evidence can be extracted from a traffic trace containing over 1.3 million flows.

2015

Internet users have been attacked by widespread email viruses earlier, but now scenario has been changed. Now attackers are no more interested to just attract media attention by infecting a large number of computers on the network; in fact, their interest has been shifted to compromising and controlling the infected computers for their personal profits. This new attack trend brings the concept of botnets over the global network of computers. With the high reported infection rates, the vast range of illegal activities and powerful comebacks, botnets are one of the main threats against the cyber security. This paper provides the readers with a background on botnet life-cycle, architecture and malicious activities. It also classifies botnet detection techniques, reviews the recent research works on botnet traffic detection and finally indicates some challenges posed to future work on botnet detection.