Zeidanloo, Hossein Rouhani and Abdul Manaf, Azizah and Ahmad, Rabiah and Zamani, Mazdak and Chaeikar, Saman Shojae (2010) A proposed framework for P2P botnet detection. International Journal of Engineering and Technology (IJET), 2 (2). pp. 161-168. ISSN 1793-8236
HTML
- Published Version
16kB |
Official URL: http://www.ijetch.org/list-30-1.html
Abstract
Botnet is most widespread and occurs commonly in today‘s cyber attacks, resulting in serious threats to our network assets and organization’s properties. Botnets are collections of compromised computers (Bots) which are remotely controlled by its originator (BotMaster) under a common Command-and-Control (C&C) infrastructure. They are used to distribute commands to Bots for malicious activities such as distributed denial-of-service (DDoS) attacks, spam and phishing. Most of the existing botnet detection approaches concentrate only on particular botnet command and control (C&C) protocols (e.g., IRC,HTTP) and structures (e.g., centralized), and can become ineffective as botnets change their structure and C&C techniques. In this paper we proposed a new detection framework which focuses on P2P based botnets. This proposed framework is based on our definition of botnets. We define a botnet as a group of bots that will perform similar communication and malicious activity patterns within the same botnet. In our proposed detection framework, we monitor the group of hosts that show similar communication pattern in one stage and also performing malicious activities in another step, and finding common hosts on them.
Item Type: | Article |
---|---|
Uncontrolled Keywords: | botnet, bot, centralized, decentralized, P2P, detection |
Subjects: | Q Science > QA Mathematics > QA75 Electronic computers. Computer science |
Divisions: | Advanced Informatics School |
ID Code: | 37017 |
Deposited By: | INVALID USER |
Deposited On: | 09 Mar 2014 08:39 |
Last Modified: | 15 Feb 2017 00:34 |
Repository Staff Only: item control page