Botnet detection by Imitation method

Botnet detection by Imitation method

• 1.
  International Conference onCommunications, Signal Processing, Computing and Information Technologies (ICCSPCIT-2015) December 8-19, 2015. 1 Abstract Botnets are software agents designed to automatically perform tasks. A botnet is a term used to describe a network of infected hosts called bots. They change their signature and make difficult to take down. Botmasters are able to infect new computers at a much faster rate than administrators can remediate them, Botnets are a significant threat to computer networks and data stored on Bigdata. They are moving towards the SSL Encryption to increase the difficulty level of detection. Our technique is based on the assumption botnet domains have a short lifetime. Index Terms— DDoS, SSL protocol, Bigdata. I. INTRODUCTION1 bot[1]is a malware which installs itself on a exploiting the vulnerability available in the machine to a network of zombies called botnet[11] which remotely restricted by a set of master named as botnet controller. Botnets are used for Distributed denial-of- service(DDoS)[2] attacks, P2P Botnets[9][10] are composed of the virus infected computers severely threaten the security of internet. Hackers, implant virus in under attack computers, which were then commanded and controlled by them throw the internet to operate distributed denial of services (DDoS), take confidential information, and distribute junk mails and other malicious acts. Newer type of botnets that uses on hand P2P protocols to distribute instructions. This kind of botnet is harder to detect compared to the other botnets. The bots are connected to the botnet through a C & C channel as a fore mentioned. A C & C channel can operate on different network topologies and communication mechanisms. II. RELATED WORK A. Review Stage Botnets are trying to move towards encryption in order to improve the confidentiality of their communication and increase the difficulty level of detection. Zeus Botnet It follow P2P architecture. Every bot is able to provide data to the other bots it makes hard to track and take down. Existing Botnet Detection Techniques Rishi[5] Use n-gram analysis with a scoring function to detect botnets and group them into white list and black list. BotHunter[6] Performs Evidence gathering for putative Infection .It is based on the Three Sensor dialog correlation BotMiner[7] It is a Protocol and structure Independent anomaly detection system it discuss the SSL blind spot[8] attack patterns. III. SYSTEM DESIGN Anomaly based detection method The most common way to identify a traffic is to use a combination of five properties from the packet a. Traffic monitoring b. Attributes Extraction c. Detecting malicious Traffic Traffic Monitoring Module Used College lab for collecting the sniffing packets from network interface. Dumpcap capture option is used to capture traffic. Attribute Extraction Extracted five attributes from the network traffic Discovery of Botnet using Imitation Technique Damalla Jyothi, JNTUH, Research Student, Hyderabad. M.A.H Farquad, Faculty of Computers and Information Systems, Islamic University of Madinah, Saudi. Prof. G.Narsimha, HOD of CSE, JNTUH College of Engineering, Sulthanpur, A
• 2.
  a. Time b. Source c.Destination d. Protocol e. Length Fig 1. Data flow of SSL Encryption IV. RESULTS Our experiment is completely based on the assumption malicious domains will have short lifetime, We used algorithm to Capture network traffic and system traces is observed in live execution environment , We clustered PCAP file data and applied Artificial neural network Algorithm for getting the suspicious bots in the network flow. Fig 2. Botnets visualization V. CONCLUSION Botnets are the main security threat on the internet due to their high reported infection rate. Since 2007 many detection approaches have been proposed and some real bot detection systems have been implemented. This experiment is completely based on the assumption malicious domains have short life time. We have detected malicious behavior on the SSL, We believe could represent a botnet. We want to do further investigations on the botnet detection by using SSL encryption. References [1] A Survey on Botnet Architectures,Detection and Defences , International Joural of Network Security,Vol. 17,No.3,PP.272-289,May 2015. [2]A Survey of Bots Used for Distributed Denial of service Attacks by vrizlynn L.L.Tging,Morris sloman,and Narankar Dulay [3] National vulnerability Data Base CVE-2015-1816 [4] National vulnerability Data Base CVE-2015-2866 [5] J.Goebel and T.Holz Rishi:identify bot contaminated hosts by IRC nickname evaluation “in Proceedings of the first conference on First Workshop on Hot Topics in Uderstanding Botnets,pp. 8,Berkely,CA,USA,2007. [6] G.Gu, P. Porras ,V.Yegneswaran, M. Fong ,and W.Lee,Bothunter:detecting malware infection through ids- driven dialog correlation , in proceedings of 16th USENIX Security Symposium on USENIX Security symposium ,pp.1-16, Berkely,CA,USA,2007. [7] G.Gu J. Zhang,and W.Lee ,Botsniffer: Detecting botnet command and control channels in network Traffic,in proceedings of 16th Annual Network and Distributed System Security Symposium(NDSS08),Reston,VA,USA,February 2008. [8] Overview of Certification System E.Gerck,1998. [9] D.Dittrich and S.Dietrich ,P 2 P as botnet command and control: a deeper insight,2008 pp,41-48. [10] R.Schoof and R. Koning Detecting peer to peer botnets University of Amsterdam,2007. [11] M.Feily,Survey of botnet and botnet detection 2009,pp 268-273.