[1]JIANG Hongling,SHAO Xiuli.Botnet detection algorithm based on neural network[J].CAAI transactions on intelligent systems,2013,8(2):113-118.[doi:10.3969/j.issn.1673-4785.201210055]
Copy

Botnet detection algorithm based on neural network

CAAI transactions on intelligent systems[ISSN 1673-4785/CN 23-1538/TP] Volume: 8 Number of periods: 2013 2 Page number: 113-118 Column: 学术论文—机器学习 Public date: 2013-04-25
Title:
Botnet detection algorithm based on neural network
Author(s):
JIANG Hongling;  SHAO Xiuli
College of Information Technical Science, Nankai University, Tianjin 300071, China
Keywords:
botnet;  BP neural network;  feature vector;  network traffic;  detection algorithm
CLC:
TP393
DOI:
10.3969/j.issn.1673-4785.201210055
Abstract:
The most current botnet detection algorithm are typically based on network traffic analyzing technologies that usually need packet payload. The botnet detection algorithm also relies on information obtained by external systems or malicious behaviors of bots that do not automatically store the features of botnet traffic and do not have the ability of associative memory. As a result, this paper proposes a botnet detection algorithm based on BP neural network which trains the BP neural network classifier through a lot of botnet and normal traffic samples and allows it to learn how to identify botnet traffic and automatically remember the features of botnet traffic and therefore, detect the infected hosts effectively. The neural network classifier takes the host-pairs as analysis objects, extracts the traffic features of communications between two hosts and takes the feature vectors of host-pairs as input, thus, effectively distinguishing the normal hosts and bots. The experimental results show that the detection rate of our algorithm can achieve to 99% and the false positive rate is below 1% and the algorithm has a good performance.
References:
［1］金鑫，李润恒，甘亮，等. 基于通信特征曲线动态时间弯曲距离的IRC僵尸网络同源判别方法［J］. 计算机研究与发展， 2012, 49(3)： 481-490.
JIN Xin, LI Runheng, GAN Liang, et al. IRC botnets’ homology identifying method based on dynamic time warping distance of communication feature curves［J］. Journal of Computer Research and Development， 2012, 49(3)： 481-490.
［2］江健, 诸葛建伟, 段海新，等. 僵尸网络机理与防御技术［J］. 软件学报， 2012, 23(1)： 82-96.
JIANG Jian, ZHUGE Jianwei, DUAN Haixin, et al. Research on botnet mechanisms and defenses［J］. Journal of Software, 2012, 23(1)： 82-96..
［3］GOEBEL J, HOLZ T. Rishi: identify bot contaminated hosts by irc nickname evaluation［C］//Proceedings of USENIX First Workshop on Hot Topics in Understanding Botnets, Cambridge, USA, 2007: 1-12.
［4］FRANCOIS J, WANG S, STATE R, et al. BotTrack: tracking botnets using NetFlow and PageRank［M］//Lecture Notes in Computer Science. Valencia, Spain, 2011： 1-14.
［5］NAGARAJA S, MITTAL P, HONG C, et al. BotGrep: finding P2P bots with structured graph analysis［C］//Proceedings of the 19th USENIX Conference on Security. Washington, DC, USA, 2010： 1-16.
［6］GU G, PERDISCI R, ZHANG J, et al. BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection［C］//Proceedings of the 17th Conference on Security Symposium. San Jose, USA, 2008: 139-154.
［7］GU G, PORRAS P, YEGNESWARAN V, et al. BotHunter: detecting malware infection through IDSdriven dialog correlation［C］//Proceedings of the 16th USENIX Security Symposium. Boston, USA, 2007: 167-182.
［8］PRASAD K, REDDY A, KARTHIK M. Flooding attacks to internet threat monitors (ITM): modeling and counter measures using botnet and honeypots［J］. International Journal of Computer Science and Information Technology, 2011, 3(6): 159-172.
［9］ZHANG J, PERDISCI R, LEE W, et al. Detecting stealthy P2P Botnets using statistical traffic fingerprints［C］//Proceedings of IEEE/IFIP 41st International Conference on Dependable Systems and Networks. Hong Kong, China, 2011: 121-132.
［10］方滨兴，崔翔，王威. 僵尸网络综述［J］. 计算机研究与发展， 2011, 48(8)： 1315-1331.
FANG binxing, CUI Xiang, WANG Wei. Survey of botnets ［J］. Journal of Computer Research and Development, 2011, 48(8): 1315-1331.
［11］WANG P, WU L, ASLAM B, et al. A systematic study on peer-to-peer botnets［C］//Proceedings on Computer Communications and Networks. San Francisco, USA, 2009: 1-8.
［12］飞思科技产品研发中心．神经网络理论与MATLAB7实现［M］.北京： 电子工业出版社， 2005: 1-108.
Similar References:

Memo

-

Last Update: 2013-05-26

Copyright © CAAI Transactions on Intelligent Systems