Please use this identifier to cite or link to this item:
Scopus Web of Science® Altmetric
Type: Journal article
Title: An adaptive framework for the detection of novel botnets
Author: Álvarez Cid-Fuentes, J.
Szabo, C.
Falkner, K.
Citation: Computers and Security, 2018; 79:148-161
Publisher: Elsevier
Issue Date: 2018
ISSN: 0167-4048
Statement of
Javier Álvarez Cid-Fuentes, Claudia Szabo, Katrina Falkner
Abstract: Detecting and disrupting botnet activities is critical for the reliability, availability and security of Internet services. However, despite many efforts in this direction, key challenges remain. These include the high computational requirements of processing large amounts of network information, the similarity between botnet and normal traffic, and the constant creation of new botnet mechanisms to bypass current detection approaches. Because of these challenges, existing detection approaches have difficulties in detecting novel botnets with high accuracy and low false positive rate. In this paper, we address this problem with an scalable and decentralized framework. Our framework creates a complete characterization of the behavior of legitimate hosts that can be used to discover previously unseen botnet traffic. Moreover, our framework dynamically adapts to changes in network traffic, and is capable of detecting novel botnets without any assumption on their architecture or protocols employed. This is crucial to nullify the constant efforts by botnet managers to adapt to current detection techniques. Through an experimental analysis using the most realistic and varied publicly available botnet dataset, we find that our framework can detect bots in a network with 1.00 TPR and 0.082 FPR or, alternatively, can detect half of the malicious hosts with a FPR as low as 0.0017. These results significantly improve the results reported by similar works in the area, with the added value of not relying on historical botnet data or specific architectures and protocols.
Keywords: Botnet detection; network analysis; network security; anomaly detection; traffic analysis
Rights: © 2018 Elsevier Ltd. All rights reserved.
RMID: 0030098386
DOI: 10.1016/j.cose.2018.07.019
Appears in Collections:Computer Science publications

Files in This Item:
There are no files associated with this item.

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.