Detecting Botnet Traffic from a Single Host

View Sample PDF

Author(s): Sebastián García (Universidad Nacional del Centro (UNICEN University), Argentina & Czech Technical University (CTU University), Czech Republic), Alejandro Zunino (Universidad Nacional del Centro (UNICEN University), Argentina)and Marcelo Campo (Universidad Nacional del Centro (UNICEN University), Argentina)
Copyright: 2015
Pages: 21
Source title: Handbook of Research on Emerging Developments in Data Privacy
Source Author(s)/Editor(s): Manish Gupta (State University of New York at Buffalo, USA)
DOI: 10.4018/978-1-4666-7381-6.ch019

Keywords: Information Science Reference / Information Security & Privacy / IT Security and Ethics / Security & Forensics

Purchase

View Detecting Botnet Traffic from a Single Host on the publisher's website for pricing and purchasing information.

Abstract

The detection of bots and botnets in the network may be improved if the analysis is done on the traffic of one bot alone. While a botnet may be detected by correlating the behavior of several bots in a large amount of traffic, one bot alone can be detected by analyzing its unique trends in less traffic. The algorithms to differentiate the traffic of one bot from the normal traffic of one computer may take advantage of these differences. The authors propose to detect bots in the network by analyzing the relationships between flow features in a time window. The technique is based on the Expectation-Maximization clustering algorithm. To verify the method they designed test-beds and obtained a dataset of six different captures. The results are encouraging, showing a true positive error rate of 99.08% with a false positive error rate of 0.7%.

The IRMA Community

Research IRM

Detecting Botnet Traffic from a Single Host

Purchase

Abstract

Related Content

IRMA Sponsors