BotCap: Machine Learning Approach for Botnet Detection Based on Statistical Features.

Mohammed S Gadelrab; Muhammad ElSheikh; Mahmoud A Ghoneim; Mohsen Rashwan

Author(s)

Mohammed S Gadelrab IT Metrology Lab, National Institute for Standards, Egypt

Muhammad ElSheikh Institute for Information Systems Engineering (CIISE), Concordia University, Canada; IT Metrology Lab, National Institute for Standards, Egypt

Mahmoud A Ghoneim Computer Science Department, School of Engineering and Applied Science, George Washington University, USA; IT Metrology Lab, National Institute for Standards, Egypt

Mohsen Rashwan Communication Engineering Department, Faculty of Engineering, Cairo University, Egypt

Abstract

In this paper, we describe a detailed approach to develop a botnet detection system using machine learning (ML) techniques. Detecting botnet member hosts, or identifying botnet traffic has been the main subject of many research efforts. This research aims to overcome two serious limitations of current botnet detection systems: First, the need for Deep Packet Inspection-DPI and the need to collect traffic from several infected hosts. To achieve that, we have analyzed several botware samples of known botnets. Based on this analysis, we have identified a set of statistical features that may help to distinguish between benign and botnet malicious traffic. Then, we have carried several machine learning experiments in order to test the suitability of ML techniques and also to pick a minimal subset of the identified features that provide best detection. We have implemented our approach in a tool called BotCap whose test results proved its ability to detect individually infected hosts in a local network.

Publication Details

Page(s) 563-579

DOI DOI not available

Published Journal: International Journal of Communication Networks and Information Security, Volume: 10, Issue: 3, Year: 2018

Request the full text from PASTIC

References

J.Wang,I. C.Paschalidis, 2017."Botnet detection based on anomaly and community detection,",IEEE Transaction on Control Network Systems 4 pp392 -404

Tzy-ShiahWang,Hui-TangLin,Wei-TsungCheng, 2017.DBod: Clustering and Detecting DGA-based Botnets Using DNS Traffic Analysis,International Journal on Computer Security, Elsevier 64 1 -15

NurHidayah Mohd Saudi,FaizalM. A,Siti RahayuSelamat,Rudy Fadhlee M. D,Wan Ahmad, 2017."Revealing the Feature Influence in HTTP Botnet Detection,",International Journal of Communication Networks and Information Security (IJCNIS) 9 274 -281

M.Hall,G.Holmes,B.Pfahringer,P.Reutemann,and I. H.Witten, 2009.The WEKA data mining software: an update”,ACM SIGKDD Explor. Newsl. 11 10 -18

J. R.Quinlan, 1993.5: Programs for Machine Learning”, C4 -

C. C.Chang,C.-J. Lin, 2011.LIBSVM: A Library for Support Vector Machines”,ACM Transaction Intelligent System Technology 2 1 -27

C. W.Hsu,C. C.Chang,C. J.Lin, 2003.A practical guide to support vector classification”,Technical Report -

A.Moore,D.Zuev, 2005.Discriminators for use in flow-based classification”,Technical Report -

A. N. Z.-H.Riyad Alshammari, 2015.Identification of VoIP Encrypted Traffic Using a Machine Learning Approach, 1 -

F.Tegeler,X.Fu, 2012.BotFinder: Finding Bots in Network Traffic Without Deep Packet Inspection”,in Proceedings of the 8th International Conference on Emerging Networking Experiments and Technologies 349 -360

P. D.Welch, 1967.The use of fast Fourier transform for the estimation of power spectra: A method based on time averaging over short, modified periodograms”,IEEE Trans. Audio Electroacoustics 15 70 -73

S. van derWalt,S. C.Colbert,G., 2011.Varoquaux, "The NumPy Array: A Structure for Efficient Numerical Computation",in Computing in Science & Engineering 13 22 -30

E.Jones,T.Oliphant,P.Peterson, 2001.SciPy: Open source scientific tools for Python”, -

MuhammadElSheikh, 2014.BoTGen: A New Approach for In-Lab Generation of Botnet Datasets”,9th IEEE International Conference on Malicious and Unwanted Software (MALCON) -

2013.“Analysis and treatment of Aryan bot”,Technical Report, Reverse Lab-Malware analysis and reversing stuff -

“SonicALERT: AryaN IRC Botnet - Part1”, 2012.,Technical Report,DELL Sonic WALL -

C.Rong Hwa, 2016.,Technical Report, InfoSec Institute -

N.Jayanand, 2012.Update: NGRBot Posing as Skype Drops Ransomware With Fake McAfee Logo”,Technical Report, McAfee -

2013.“SonicALERT: Gone with the wings ngrBot dropper”,Technical Report, DELL-SonicWALL -

E.Patil, 2009.Analysis of Rxbot”,Master Thesis -

G.Gu,R.Perdisci,J.Zhang,W.Lee,Structure-Independent Botnet, 2008.BotMiner: Clustering Analysis of Network Traffic for Protocol-,In Proceedings of the 17th USENIX Security Symposium 139 -154

G.Gu,J.Zhang,W.Lee, 2008.BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic”,Proceedings of the 15th Annual Network and Distributed System Security Symposium -

T.-F. Yen and M. K. Reiter, 2008.Traffic aggregation for malware detection,” in the proceeding of Detection of Intrusions and Malware, and Vulnerability Assessment (,DIMVA'08) 207 -227

F.Tegeler,X.Fu,C.Kruegel, 2012.Botfinder: Finding Bots In Network Traffic Without Deep Packet Inspection,”,In Proceedings of the 8th International Conference on Emerging Networking Experiments and Technologies 349 -360

J.Zhang,X.Luo,R.Perdisci,W.Lee,N.Feamster, 2011.Boosting The Scalability Of Botnet Detection Using Adaptive Traffic Sampling,”,In Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security 124 -134

T.-F. Yen and M. K. Reiter, 2010.Are Your Hosts Trading Or Plotting? Telling P2P File-Sharing and Bots Apart”,In Proceeding of IEEE 30th International Conference on Distributed Computing Systems (ICDCS) 241 -252

N.Kheir,C.Wolley, 2013.Botsuer: Suing Stealthy P2P Bots In Network Traffic Through Netflow Analysis”,In Poceeding of Cryptology and Network Security 162 -178

B.Rahbarinia,R.Perdisci,A.Lanzi,K.Li, 2014.Peerrush: Mining For Unwanted P2P Traffic,”,Journal of Information Security and Applications 19 194 -208

J.Zhang,R.Perdisci,W.Lee,U.Sarfraz,X.Luo, 2011.Detecting Stealthy P2P Botnets Using Statistical Traffic Fingerprints,”,In the Proceeding of IEEE/IFIP 41st International Conference on Dependable Systems & Networks (DSN) 121 -132

J.Zhang,R.Perdisci,W.Lee,X.Luo, 2014.Building A Scalable System for Stealthy P2P-Botnet Detection”,IEEE Transactions on Information Forensics and Security 9 27 -38

J.Nazario, 2007.Blackenergy DDoS Bot Analysis”,Technical Report 11 -

C.Shah, 2011.Evolving DDoS Botnets: 1,Technical Report, McAfee -

H.Binsalleeh,T.Ormerod,A.Boukhtouta,P.Sinha,A.Youssef,M.Debbabi,L.Wang, 2010.On The Analysis of The Zeus Botnet Crimeware Toolkit,”,In the Proceeding of the 8th Annual International Conference on Privacy Security and Trust (PST) 31 -38

C.Shah, 2010.,Technical Report, McAfee -

C.Livadas,R.Walsh,D.Lapsley,W. T.Strayer, 2006."Usilng Machine Learning Technliques to Identify Botnet Traffic",Proceedings of the 31st IEEE Conference on Local Computer Networks 967 -974

D.Danchev, 2011.A Peek Inside the Vertex Net Loader,” Dancho Danchev's Blog -,Streams of Information Security Knowledge -

.“Malware Intelligence Blog: VertexNet Loader crimeware timeline, popular functions and marketing schene. A division of Malware Intelligence, 02 -Jan2014

2011.,Technical Report, Symantec -

F.Gringoli,L.Salgarelli,M.Dusi,N.Cascarano,F.Risso, 2009.GT: Picking Up the Truth from the Ground for Internet Traffic”,SIGCOMM Review of Computer Communication 39 12 -18

AthenaIRC, ., -

J.Milletary, 2012.Citadel Trojan Malware Analysis”,Technical Report, DELL SecureWorks -

A.Rahimian,R.Ziarati,S.Preda,M.Debbabi, 2014.On the Reverse Engineering of the Citadel Botnet,”,in Foundations and Practice of Security 408 -425

K. P.Bennett,E.Parrado-Hernández, 2006.The interplay of optimization and machine learning research,” Journal of Machine Learning Research 7 1265 -1281

C.Thornton,F.Hutter,H. H.Hoos, 2013.Auto-WEKA: Combined Selection and Hyperparameter Optimization of Classification Algorithms,”,in Proceedings of the 19th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining 847 -855

J.Bergstra,Y.Bengio, 2012.Random Search for HyperParameter Optimization,” Journal of Machine Learning Research 13 281 -305

N. V.Chawla, 2005.Data mining for imbalanced datasets: An overview,” in Data mining and knowledge discovery handbook, 853 -867

G.Forman and M. Scholz, 2010.Apples-to-apples in Crossvalidation Studies: Pitfalls in Classifier Performance Measurement”,SIGKDD Explor Newsl 12 49 -57

V. Van Asch, 2013.Macro-and micro-averaged evaluation measures [[,BASIC DRAFT]]” -

ARGUS- Auditing Network,December2018, December 2018., 10 -