An Effective Conversation-Based Botnet Detection Method

Ruidong Chen, Weina Niu, Xiaosong Zhang, Zhongliu Zhuo and Fengmao Lv

Mathematical Problems in Engineering, 2017, vol. 2017, 1-9

Abstract:

A botnet is one of the most grievous threats to network security since it can evolve into many attacks, such as Denial-of-Service (DoS), spam, and phishing. However, current detection methods are inefficient to identify unknown botnet. The high-speed network environment makes botnet detection more difficult. To solve these problems, we improve the progress of packet processing technologies such as New Application Programming Interface (NAPI) and zero copy and propose an efficient quasi-real-time intrusion detection system. Our work detects botnet using supervised machine learning approach under the high-speed network environment. Our contributions are summarized as follows: (1) Build a detection framework using PF_RING for sniffing and processing network traces to extract flow features dynamically. (2) Use random forest model to extract promising conversation features. (3) Analyze the performance of different classification algorithms. The proposed method is demonstrated by well-known CTU13 dataset and nonmalicious applications. The experimental results show our conversation-based detection approach can identify botnet with higher accuracy and lower false positive rate than flow-based approach.

Date: 2017
References: Add references at CitEc
Citations: View citations in EconPapers (3)

Downloads: (external link)
http://downloads.hindawi.com/journals/MPE/2017/4934082.pdf (application/pdf)
http://downloads.hindawi.com/journals/MPE/2017/4934082.xml (text/xml)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:hin:jnlmpe:4934082

DOI: 10.1155/2017/4934082

Access Statistics for this article

More articles in Mathematical Problems in Engineering from Hindawi
Bibliographic data for series maintained by Mohamed Abdelhakeem ().