- About EITEE
- Articles Online
- For Authors
- For Reviewers
- Features
- Subscription & Service
- Personal Center
- Logout
FOLLOWUS
- About EITEE
- Introduction
- Editorial Board
- Corresponding Experts
- Events
- Honors
- Contact Us
- Articles Online
- Current Issue
- Archive
- Special Issues
- Virtual Issues
- Highlights
- In Press
- For Authors
- Submit
- Call for papers
- Guide for Authors
- Ethics & Disclosures
- Fee & Funding
- Downloads
- For Reviewers
- Guide for Reviewers
- Ethics & Disclosures
- Thanks card
- Features
- FITEE Forum
- Engineering Front
- Paper Videos
- Editors’ Corner
- Other Resources
- Subscription & Service
- Subscription
- Services
Detecting P2P bots by mining the regional periodicity
- Detecting P2P bots by mining the regional periodicity
- Frontiers of Information Technology & Electronic Engineering Vol. 14, Issue 9, Pages: 682-700(2013)
- Affiliations：
1.College of Computer, National University of Defense Technology, Changsha 410073, China
2.Information Center, National University of Defense Technology, Changsha 410073, China
- Author bio：
[ "Yong QIAO, E-mail: qiaoyong10@nudt.edu.cn" ]
- Funds：
DOI：10.1631/jzus.C1300053
CLC： TP393.08Received：25 February 2013，
Revised：2013-;8-;7，
Published：2013-09
- Accepted：
Scan QR Code
Yong QIAO, Yue-xiang YANG, Jie HE, et al. Detecting P2P bots by mining the regional periodicity[J]. Frontiers of Information Technology & Electronic Engineering, 2013, 14(9): 682-700.
Yong QIAO, Yue-xiang YANG, Jie HE, et al. Detecting P2P bots by mining the regional periodicity[J]. Frontiers of Information Technology & Electronic Engineering, 2013, 14(9): 682-700. DOI： 10.1631/jzus.C1300053.
摘要
Abstract
Peer-to-peer (P2P) botnets outperform the traditional Internet relay chat (IRC) botnets in evading detection and they have become a prevailing type of threat to the Internet nowadays. Current methods for detecting P2P botnets
such as similarity analysis of network behavior and machine-learning based classification
cannot handle the challenges brought about by different network scenarios and botnet variants. We noticed that one important but neglected characteristic of P2P bots is that they periodically send requests to update their peer lists or receive commands from botmasters in the command-and-control (C & C) phase. In this paper
we propose a novel detection model named detection by mining regional periodicity (DMRP)
including capturing the event time series
mining the hidden periodicity of host behaviors
and evaluating the mined periodic patterns to identify P2P bot traffic. As our detection model is built based on the basic properties of P2P protocols
it is difficult for P2P bots to avoid being detected as long as P2P protocols are employed in their C & C. For hidden periodicity mining
we introduce the so-called regional periodic pattern mining in a time series and present our algorithms to solve the mining problem. The experimental evaluation on public datasets demonstrates that the algorithms are promising for efficient P2P bot detection in the C & C phase.
关键词
Keywords
references
R. Agrawal , , , R. Srikant . . Fast Algorithms for Mining Association Rules . . Proc. 20th Int. Conf. on Very Large Data Bases , , 1994 . . p.487 - - 499 . . . .
E. Athanasopoulos , , , A. Makridakis , , , S. Antonatos , , , D. Antoniades , , , S. Ioannidis , , , K.G. Anagnostakis , , , E.P. Markatos . . Antisocial networks: turning a social network into a botnet . . LNCS , , 2008 . . 5222 146 - - 160 . . DOI: 10.1007/978-3-540-85886-7_10 http://doi.org/10.1007/978-3-540-85886-7_10 . .
G. Bartlett , , , J. Heidemann , , , C. Papadopoulos . . Low-Rate, Flow-Level Periodicity Detection . . IEEE Conf. on Computer Communications Workshops , , 2011 . . p.804 - - 809 . . . .
C. Berberidis , , , W.G. Aref , , , M. Atallah , , , I. Vlahavas , , , A.K. Elmagarmid . . Multiple and Partial Periodicity Mining in Time Series Databases . . European Conf. on Artificial Intelligence , , 2002 . . p.370 - - 374 . . . .
R.N. Bracewell , , , R. Bracewell . . The Fourier Transform and Its Applications , , : : New York McGraw-Hill , , 1986 . . .
L. Cohen . . Convolution, filtering, linear systems, the Wiener-Khinchin theorem: generalizations . . SPIE , , 1992 . . 1770 378 - - 393 . . DOI: 10.1117/12.130944 http://doi.org/10.1117/12.130944 . .
D. Fisher . . Storm, Nugache Lead Dangerous New Botnet Barrage . . Available from SearchSecurity.com , , 2007 . . .
J.B. Grizzard , , , V. Sharma , , , C. Nunnery , , , B.B.H. Kang , , , D. Dagon . . Peer-to-Peer Botnets: Overview and Case Study . . Proc. 1st Conf. on 1st Workshop on Hot Topics in Understanding Botnets , , 2007 . . p.1 . .
G. Gu , , , R. Perdisci , , , J. Zhang , , , W. Lee . . BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection . . USENIX Security Symp. , , 2008 . . p.139 - - 154 . . . .
J. Han , , , G. Dong , , , Y. Yin . . Efficient Mining of Partial Periodic Patterns in Time Series Database . . Proc. 15th IEEE Int. Conf. on Data Engineering , , 1999 . . p.106 - - 115 . . . .
J. Han , , , H. Cheng , , , D. Xin , , , X. Yan . . Frequent pattern mining: current status and future directions . . Data Min. Knowl. Discov. , , 2007 . . 15 ( ( 1 ): ): 55 - - 86 . . DOI: 10.1007/s10618-006-0059-1 http://doi.org/10.1007/s10618-006-0059-1 . .
T. Holz , , , M. Steiner , , , F. Dahl , , , E. Biersack , , , F. Freiling . . Measurements and Mitigation of Peer-to-Peer-Based Botnets: a Case Study on Storm Worm . . USENIX Workshop on Large-Scale Exploits and Emergent Threats , , 2008 . . p.1 - - 9 . . . .
J. Kang , , , Y.Z. Song , , , J.Y. Zhang . . Accurate detection of peer-to-peer botnet using multi-stream fused scheme . . J. Networks , , 2011 . . 6 ( ( 5 ): ): 807 - - 814 . . DOI: 10.4304/jnw.6.5.807-814 http://doi.org/10.4304/jnw.6.5.807-814 . .
J.S. Lee , , , H.C. Jeong , , , J.H. Park , , , M. Kim , , , B.N. Noh . . The Activity Analysis of Malicious HTTP-Based Botnets Using Degree of Periodic Repeatability . . Int. Conf. on Security Technology , , 2008 . . p.83 - - 86 . . DOI: 10.1109/SecTech.2008.52 http://doi.org/10.1109/SecTech.2008.52 . .
Z. Li , , , B. Ding , , , J. Han , , , R. Kays , , , P. Nye . . Mining Periodic Behaviors for Moving Objects . . Proc. 16th ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining , , 2010 . . p.1099 - - 1108 . . DOI: 10.1145/1835804.1835942 http://doi.org/10.1145/1835804.1835942 . .
Z. Li , , , J. Wang , , , J. Han . . Mining Event Periodicity from Incomplete Observations . . Proc. 18th ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining , , 2012 . . p.444 - - 452 . . DOI: 10.1145/2339530.2339604 http://doi.org/10.1145/2339530.2339604 . .
S. Ma , , , J.L. Hellerstein . . Mining Partially Periodic Event Patterns with Unknown Periods . . Proc. 17th IEEE Int. Conf. on Data Engineering , , 2001 . . p.205 - - 214 . . DOI: 10.1109/ICDE.2001.914829 http://doi.org/10.1109/ICDE.2001.914829 . .
M.M. Masud , , , J. Gao , , , L. Khan , , , J. Han , , , B. Thuraisingham . . Mining Concept-Drifting Data Stream to Detect Peer to Peer Botnet Traffic . . Available from , , 2008 . . http://www.utdallas.edu/mmm058000/reports/UTDCS-05-08.pdf http://www.utdallas.edu/mmm058000/reports/UTDCS-05-08.pdf , , . .
P. Maymounkov , , , D. Mazieres . . Kademlia: a Peer-to-Peer Information System Based on the XOR Metric . . Peer-to-Peer Systems , , 2002 . . p.53 - - 65 . . DOI: 10.1007/3-540-45748-8_5 http://doi.org/10.1007/3-540-45748-8_5 . .
A. Nappa , , , A. Fattori , , , M. Balduzzi , , , M. Dell'amico , , , L. Cavallaro . . Take a Deep Breath: a Stealthy, Resilient and Cost-Effective Botnet Using Skype. In : Kreibich, C.J.M. (Ed.), Detection of Intrusions and Malware, and Vulnerability Assessment . . Springer Berlin Heidelberg , , 2010 . . p.81 - - 100 . . DOI: 10.1007/978-3-642-14215-4_5 http://doi.org/10.1007/978-3-642-14215-4_5 . .
S.K. Noh , , , J.H. Oh , , , J.S. Lee , , , B.N. Noh , , , H.C. Jeong . . Detecting P2P Botnets Using a Multi-phased Flow Model . . IEEE 3rd Int. Conf. on Digital Societ , , 2009 . . p.247 - - 253 . . DOI: 10.1109/ICDS.2009.37 http://doi.org/10.1109/ICDS.2009.37 . .
R. Perdisci , , , G. Gu , , , W. Lee . . Using an Ensemble of One-Class SVM Classifiers to Harden Payload-Based Anomaly Detection Systems . . IEEE 6th Int. Conf. on Data Mining , , 2006 . . p.488 - - 498 . . DOI: 10.1109/ICDM.2006.165 http://doi.org/10.1109/ICDM.2006.165 . .
Y. Qiao , , , Y. Yang , , , J. He , , , B. Liu , , , Y. Zeng . . Detecting parasite P2P botnet in eMule-like networks through quasi-periodicity recognition . . LNCS , , 2012 . . 7259 127 - - 139 . . DOI: 10.1007/978-3-642-31912-9_9 http://doi.org/10.1007/978-3-642-31912-9_9 . .
S. Saad , , , I. Traore , , , A. Ghorbani , , , B. Sayed , , , D. Zhao , , , W. Lu , , , J. Felix , , , P. Hakimian . . Detecting P2P Botnets Through Network Behavior Analysis and Machine Learning . . IEEE 9th Annual Int. Conf. on Privacy, Security and Trust , , 2011 . . p.174 - - 180 . . DOI: 10.1109/PST.2011.5971980 http://doi.org/10.1109/PST.2011.5971980 . .
C. Sheng , , , W. Hsu , , , M.L. Lee . . Mining Dense Periodic Patterns in Time Series Data . . Proc. 22nd Int. Conf. on Data Engineering , , 2006 . . p.115 DOI: 10.1109/ICDE.2006.97 http://doi.org/10.1109/ICDE.2006.97 . .
G. Starnberger , , , C. Kruegel , , , E. Kirda . . Overbot: a Botnet Protocol Based on Kademlia . . Proc. 4th Int. Conf. on Security and Privacy in Communication Networks , , 2008 . . Article 13 DOI: 10.1145/1460877.1460894 http://doi.org/10.1145/1460877.1460894 . .
R. Villamarin-Salomon , , , J.C. Brustoloni . . Bayesian Bot Detection Based on DNS Traffic Similarity . . Proc. ACM Symp. on Applied Computing , , 2009 . . p.2035 - - 2041 . . DOI: 10.1145/1529282.1529734 http://doi.org/10.1145/1529282.1529734 . .
R. Vogt , , , J. Aycock , , , M.J.Jr Jacobson . . Army of Botnets . . Network and Distributed System Security Symp. , , 2007 . . p.111 - - 123 . . . .
P. Wang , , , B. Aslam , , , C.C. Zou . . Peer-to-Peer Botnets. In : Handbook of Information and Communication Security . . Springer , , 2010a . . p.335 - - 350 . . . .
P. Wang , , , S. Sparks , , , C.C. Zou . . An advanced hybrid peer-to-peer botnet . . IEEE Trans. Depend. Secur. Comput. , , 2010b . . 7 ( ( 2 ): ): 113 - - 127 . . DOI: 10.1109/TDSC.2008.35 http://doi.org/10.1109/TDSC.2008.35 . .
J. Yang , , , W. Wang , , , P.S. Yu . . Mining asynchronous periodic patterns in time series data . . IEEE Trans. Knowl. Data Eng. , , 2003 . . 15 ( ( 3 ): ): 613 - - 628 . . DOI: 10.1109/TKDE.2003.1198394 http://doi.org/10.1109/TKDE.2003.1198394 . .
- L-PDFDownload
- Meta-XMLDownload
- BibTeXDownload
- EndnoteDownload
- RefMan Download
- NoteExpressDownload
- NoteFirstDownload
Publicity Resources
Related Articles
Related Author
Related Institution
Chat- Address：Zhejiang University Press, 148 Tianmushan Road, Hangzhou, China Postal code：310028
- Tel：+86-571-88273162 Email：fitee@zju.edu.cn
- Copyright © 2000 - 2025, Zhejiang University Press 京ICP备09064830号-19
京公网安备11010802024621 - It is recommended to read the content of this site in Chrome&IE9+. Please switch to extreme mode in browser 360.
- Cookies We use cookies to help provide and enhance our service and tailor content. By continuing, you agree to the use of cookies.
