Detection of Covert Botnet Command and Control Channels by Causal Analysis of Traffic Flows
نویسندگان
چکیده
The Command and Control communication of a botnet is evolving into sophisticated covert communication. Techniques as encryption, steganography, and recently the use of social network websites as a proxy, impede conventional detection of botnet communication. In this paper we propose detection of covert communication by passive hostexternal analysis of causal relationships between traffic flows and prior traffic or user activity. Identifying the direct causes of traffic flows, allows for real-time bot detection with a low exposure to malware, and offline forensic analysis of traffic. The proposed causal analysis of traffic is experimentally evaluated by a self-developed tool called CITRIC with various types of real Command and Control traffic.
منابع مشابه
BotOnus: an online unsupervised method for Botnet detection
Botnets are recognized as one of the most dangerous threats to the Internet infrastructure. They are used for malicious activities such as launching distributed denial of service attacks, sending spam, and leaking personal information. Existing botnet detection methods produce a number of good ideas, but they are far from complete yet, since most of them cannot detect botnets in an early stage ...
متن کاملCoCoSpot: Clustering and recognizing botnet command and control channels using traffic analysis
We present CoCoSpot, a novel approach to recognize botnet command and control channels solely based on traffic analysis features, namely carrier protocol distinction, message length sequences and encoding differences. Thus, CoCoSpot can deal with obfuscated and encrypted C&C protocols and complements current methods to fingerprint and recognize botnet C&C channels. Using average-linkage hierarc...
متن کاملCovert Channel in the BitTorrent Tracker Protocol
Covert channels have the unique quality of masking evidence that a communication has ever occurred between two parties. For spies and terrorist cells, this quality can be the difference between life and death. However, even the detection of communications in a botnet could be troublesome for its creators. To evade detection and prevent insights into the size and members of a botnet, covert chan...
متن کاملA Novel Botnet Detection Based on IP Flows and Time Intervals
Botnet detection is one of the most emerging topic recently. In this article we would like to introduce a novel method based on IP flows to detect botnets through command and control behaviors. This is a combination of both machine learning and regression, which can reduce time interval to monitor network traffic significantly.
متن کاملExploiting Temporal Persistence to Detect Covert Botnet Channels
We describe a method to detect botnet command and control traffic and individual end-hosts. We introduce the notion of ”destination traffic atoms” which aggregate the destinations and services that are communicated with. We then compute the ”persistence”, which is a measure of temporal regularity and that we propose in this paper, for individual destination atoms. Very persistent destination at...
متن کامل