TY - GEN
T1 - Detection and classification of different botnet C&C channels
AU - Fedynyshyn, Gregory
AU - Chuah, Mooi Choo
AU - Tan, Gang
PY - 2011
Y1 - 2011
N2 - Unlike other types of malware, botnets are characterized by their command and control (C&C) channels, through which a central authority, the botmaster, may use the infected computer to carry out malicious activities. Given the damage botnets are capable of causing, detection and mitigation of botnet threats are imperative. In this paper, we present a host-based method for detecting and differentiating different types of botnet infections based on their C&C styles, e.g., IRC-based, HTTP-based, or peer-to-peer (P2P) based. Our ability to detect and classify botnet C&C channels shows that there is an inherent similarity in C&C structures for different types of bots and that the network characteristics of botnet C&C traffic is inherently different from legitimate network traffic. The best performance of our detection system has an overall accuracy of 0.929 and a false positive rate of 0.078.
AB - Unlike other types of malware, botnets are characterized by their command and control (C&C) channels, through which a central authority, the botmaster, may use the infected computer to carry out malicious activities. Given the damage botnets are capable of causing, detection and mitigation of botnet threats are imperative. In this paper, we present a host-based method for detecting and differentiating different types of botnet infections based on their C&C styles, e.g., IRC-based, HTTP-based, or peer-to-peer (P2P) based. Our ability to detect and classify botnet C&C channels shows that there is an inherent similarity in C&C structures for different types of bots and that the network characteristics of botnet C&C traffic is inherently different from legitimate network traffic. The best performance of our detection system has an overall accuracy of 0.929 and a false positive rate of 0.078.
UR - http://www.scopus.com/inward/record.url?scp=80052738809&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=80052738809&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-23496-5_17
DO - 10.1007/978-3-642-23496-5_17
M3 - Conference contribution
AN - SCOPUS:80052738809
SN - 9783642234958
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 228
EP - 242
BT - Autonomic and Trusted Computing - 8th International Conference, ATC 2011, Proceedings
T2 - 8th International Conference on Autonomic and Trusted Computing, ATC 2011
Y2 - 2 September 2011 through 4 September 2011
ER -