BotSpot: fast graph based identification of structured P2P bots

Bharath Venkatesh, Sudip Hazra Choudhury, Shishir Nagaraja, N. Balakrishnan

Research output: Contribution to journalArticle

6 Citations (Scopus)

Abstract

An essential component of a botnet is the Command and Control (C2) channel (a network). The mechanics of C2 establishment often involve the use of structured overlay techniques which create a scaffolding for sophisticated coordinated activities. However, it can also be used as a point of detection because of their distinct communication patterns. Achieving this is a needle-in-a-haystack search problem across distributed vantage points. The search technique must be efficient given the high traffic throughput of modern core routers. In this paper, we focus on efficient algorithms for C2 channel detection. Experimental results on real Internet traffic traces from an ISP’s backbone network indicate that our techniques, (i) have time complexity linear in the volume of traffic, (ii) have high F-measure, and (iii) are robust to the partial visibility arising from partial deployment of monitoring systems, and measurement inaccuracies arising from partial visibility and dynamics of background traffic.

LanguageEnglish
Pages247-261
Number of pages15
JournalJournal of Computer Virology and Hacking Techniques
Volume11
Issue number4
DOIs
Publication statusPublished - 1 Nov 2015

Fingerprint

Visibility
Routers
Mechanics
Throughput
Internet
Monitoring
Communication
Botnet

Keywords

  • distribute hash table
  • internet protocol address
  • community detection algorithm
  • dense subgraph
  • domain name service

Cite this

Venkatesh, Bharath ; Choudhury, Sudip Hazra ; Nagaraja, Shishir ; Balakrishnan, N. / BotSpot : fast graph based identification of structured P2P bots. In: Journal of Computer Virology and Hacking Techniques. 2015 ; Vol. 11, No. 4. pp. 247-261.
@article{d17f253855a1498c88f174e665592fa8,
title = "BotSpot: fast graph based identification of structured P2P bots",
abstract = "An essential component of a botnet is the Command and Control (C2) channel (a network). The mechanics of C2 establishment often involve the use of structured overlay techniques which create a scaffolding for sophisticated coordinated activities. However, it can also be used as a point of detection because of their distinct communication patterns. Achieving this is a needle-in-a-haystack search problem across distributed vantage points. The search technique must be efficient given the high traffic throughput of modern core routers. In this paper, we focus on efficient algorithms for C2 channel detection. Experimental results on real Internet traffic traces from an ISP’s backbone network indicate that our techniques, (i) have time complexity linear in the volume of traffic, (ii) have high F-measure, and (iii) are robust to the partial visibility arising from partial deployment of monitoring systems, and measurement inaccuracies arising from partial visibility and dynamics of background traffic.",
keywords = "distribute hash table, internet protocol address, community detection algorithm, dense subgraph, domain name service",
author = "Bharath Venkatesh and Choudhury, {Sudip Hazra} and Shishir Nagaraja and N. Balakrishnan",
year = "2015",
month = "11",
day = "1",
doi = "10.1007/s11416-015-0250-2",
language = "English",
volume = "11",
pages = "247--261",
journal = "Journal of Computer Virology and Hacking Techniques",
issn = "2274-2042",
number = "4",

}

BotSpot : fast graph based identification of structured P2P bots. / Venkatesh, Bharath; Choudhury, Sudip Hazra; Nagaraja, Shishir; Balakrishnan, N.

In: Journal of Computer Virology and Hacking Techniques, Vol. 11, No. 4, 01.11.2015, p. 247-261.

Research output: Contribution to journalArticle

TY - JOUR

T1 - BotSpot

T2 - Journal of Computer Virology and Hacking Techniques

AU - Venkatesh, Bharath

AU - Choudhury, Sudip Hazra

AU - Nagaraja, Shishir

AU - Balakrishnan, N.

PY - 2015/11/1

Y1 - 2015/11/1

N2 - An essential component of a botnet is the Command and Control (C2) channel (a network). The mechanics of C2 establishment often involve the use of structured overlay techniques which create a scaffolding for sophisticated coordinated activities. However, it can also be used as a point of detection because of their distinct communication patterns. Achieving this is a needle-in-a-haystack search problem across distributed vantage points. The search technique must be efficient given the high traffic throughput of modern core routers. In this paper, we focus on efficient algorithms for C2 channel detection. Experimental results on real Internet traffic traces from an ISP’s backbone network indicate that our techniques, (i) have time complexity linear in the volume of traffic, (ii) have high F-measure, and (iii) are robust to the partial visibility arising from partial deployment of monitoring systems, and measurement inaccuracies arising from partial visibility and dynamics of background traffic.

AB - An essential component of a botnet is the Command and Control (C2) channel (a network). The mechanics of C2 establishment often involve the use of structured overlay techniques which create a scaffolding for sophisticated coordinated activities. However, it can also be used as a point of detection because of their distinct communication patterns. Achieving this is a needle-in-a-haystack search problem across distributed vantage points. The search technique must be efficient given the high traffic throughput of modern core routers. In this paper, we focus on efficient algorithms for C2 channel detection. Experimental results on real Internet traffic traces from an ISP’s backbone network indicate that our techniques, (i) have time complexity linear in the volume of traffic, (ii) have high F-measure, and (iii) are robust to the partial visibility arising from partial deployment of monitoring systems, and measurement inaccuracies arising from partial visibility and dynamics of background traffic.

KW - distribute hash table

KW - internet protocol address

KW - community detection algorithm

KW - dense subgraph

KW - domain name service

UR - http://www.scopus.com/inward/record.url?scp=84945493242&partnerID=8YFLogxK

U2 - 10.1007/s11416-015-0250-2

DO - 10.1007/s11416-015-0250-2

M3 - Article

VL - 11

SP - 247

EP - 261

JO - Journal of Computer Virology and Hacking Techniques

JF - Journal of Computer Virology and Hacking Techniques

SN - 2274-2042

IS - 4

ER -