International Conference on the Digital Society (2009)
Feb. 1, 2009 to Feb. 7, 2009
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ICDS.2009.37
In this paper, we propose a useful method for modeling multi-phased flows of P2P botnet traffic. Botnets are becoming more sophisticated and more dangerous each day and attackers use the P2P protocol to avoid centralized botnet topologies. We focus on the feature that a peer bot generates multiple traffic to communicate with large number of remote peers. In this case, phased botnet flows have similar patterns, which occur at irregular intervals. We compress duplicated flows via flow grouping and construct a transition model of the clustered flows using a probability-based matrix. A flow state is decided by features consisting of; protocol, port, and traffic. Our model involves transition information about the state values. Finally, we use the likelihood ratio for detection. In the experimental evaluation, we show the efficiency of our proposed system with the SpamThru, Storm, and Nugache botnets.
botnet, peer-to-peer, multi-phased flow, intrusion detection, digital society
B. Noh, H. Jeong, J. Oh, S. Noh and J. Lee, "Detecting P2P Botnets Using a Multi-phased Flow Model," International Conference on the Digital Society(ICDS), vol. 00, no. , pp. 247-253, 2009.