• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>International Journal of Performability Engineering >BotCapturer: Detecting Botnets based on Two-Layered Analysis with Graph Anomaly Detection and Network Traffic Clustering
【24h】

BotCapturer: Detecting Botnets based on Two-Layered Analysis with Graph Anomaly Detection and Network Traffic Clustering

机译：Botcapture：基于Traph异常检测和网络流量聚类的两层分析检测僵尸网络

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Botnets have become one of the most serious threats on the Internet. On the platform of botnets, attackers conduct series of malicious activities such as distributed denial-of-service (DDoS) or virtual currencies mining. Network traffic has been widely used as the data source for the detection of botnets. However, there are two main issues on the detection of botnets with network traffic. First, many traditional filtering methods such as whitelisting are not able to process the very large amount of traffic data in real-time due to their limited computational capability. Second, many existing detection methods, based on network traffic clustering, result in high false positive rates. In this work, we are motivated to resolve the above two issues by proposing a lightweight botnet detection system called BotCapturer, based on two-layered analysis with anomaly detection in graph and network communication traffic clustering. First, we identify anomalous nodes that correspond to C&C (Control and Command) servers with anomaly scores in a graph abstracted from the network traffic. Second, we take advantage of clustering algorithms to check whether the nodes interacting with an anomalous node share similar communication pattern. In order to minimize irrelevant traffic, we propose a traffic reduction method to reduce more than 85% background traffic. The reduction is conducted by filtering the packets that are unrelated to the hosts like C&C server. We collect a very big dataset by simulating five different botnets and mixing the collected traffic with background traffic obtained from ISP. Extensive experiments are conducted and evaluation results based on our own dataset show that BotCapturer reduces more than 85% input raw packet traces and achieves a high detection rate (100%) with a low false positive rate (0.01%), demonstrating that it is very effective and efficient in detecting latest botnets.
机译：僵尸网络已成为互联网上最严重的威胁之一。在僵尸网络的平台上，攻击者进行一系列恶意活动，如分布式拒绝服务（DDOS）或虚拟货币挖掘。网络流量已被广泛用作检测僵尸网络的数据源。但是，有两个主要问题有关网络流量的僵尸网络的主要问题。首先，许多传统的滤波方法，例如白名单，由于其有限的计算能力而实时地无法在实时处理大量的流量数据。其次，许多现有的检测方法，基于网络流量聚类，导致高误率。在这项工作中，我们通过提出一种具有叫做BotcapTurer的轻量级僵尸网络检测系统来解决上述两个问题，基于与图形和网络通信流量聚类的异常检测，基于双层分析。首先，我们识别对应于从网络流量抽象的图表中具有异常分数的C＆C（控制和命令）服务器对应的异常节点。其次，我们利用聚类算法来检查节点是否与异常节点相互作用共享类似的通信模式。为了最大限度地减少无关的交通，我们提出了一种交通减少方法，以减少超过85％的背景流量。通过过滤与C＆C服务器如C＆C Server不相关的数据包进行减少。我们通过模拟五种不同的僵尸网络来收集一个非常大的数据集，并将收集的流量与从ISP获得的后台流量混合。进行了广泛的实验，并根据我们自己的数据集进行评估结果，表明Botcapterer降低了超过85％的输入原始包裹痕迹，并达到低误率（0.01％）的高检测率（100％），表明它非常在检测最新的僵尸网络中有效和有效。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号