Detecting Botnets with Tight Command and Control

Systems are attempting to detect botnets by examining traffic content for IRC commands or by setting up honeynets. Our approach for detecting botnets is to examine flow characteristics such as bandwidth, duration, and packet timing looking for evidence of botnet command and control activity. We have...

Full description

Saved in:
Bibliographic Details
Main Authors: Strayer, W.T., Walsh, R., Livadas, C., Lapsley, D.
Format: Conference Proceeding
Language:English
Subjects:
Bandwidth
Command and control systems
Communication system traffic control
Computer networks
Control systems
Government
Hospitals
Information security
Internet
Timing
Citations: Items that cite this one
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Systems are attempting to detect botnets by examining traffic content for IRC commands or by setting up honeynets. Our approach for detecting botnets is to examine flow characteristics such as bandwidth, duration, and packet timing looking for evidence of botnet command and control activity. We have constructed an architecture that first eliminates traffic that is unlikely to be a part of a botnet, classifies the remaining traffic into a group that is likely to be part of a botnet, then correlates the likely traffic to find common communications patterns that would suggest the activity of a botnet. Our results show that botnet evidence can be extracted from a traffic trace containing almost 9 million flows
ISSN:0742-1303
DOI:10.1109/LCN.2006.322100