Detecting P2P bots by mining the regional periodicity

Yong QIAO; Yue-xiang YANG; Jie HE; Chuan TANG; Ying-zhi ZENG

doi:10.1631/jzus.C1300053

Your Location：

Home >

Browse articles >

Detecting P2P bots by mining the regional periodicity

计算机与自动化 | Updated：2022-12-09

- Detecting P2P bots by mining the regional periodicity
- Detecting P2P bots by mining the regional periodicity
- 信息与电子工程前沿（英文） 2013年14卷第9期页码：682-700
- Affiliations：
  
  1.College of Computer, National University of Defense Technology, Changsha 410073, China
  2.Information Center, National University of Defense Technology, Changsha 410073, China
- Author bio：
  
  [ "Yong QIAO, E-mail: qiaoyong10@nudt.edu.cn" ]
- Funds：
  
  Project (Nos. 61170286 and 61202486) supported by the National Natural Science Foundation of China
- DOI：10.1631/jzus.C1300053
  中图分类号： TP393.08
- 收稿：2013-02-25，
  
  修回：2013-;8-;7，
  
  纸质出版：2013-09
- Accepted：
Scan QR Code
Detecting P2P bots by mining the regional periodicity[J]. 信息与电子工程前沿（英文）, 2013,14(9):682-700.

Yong QIAO, Yue-xiang YANG, Jie HE, et al. Detecting P2P bots by mining the regional periodicity[J]. Frontiers of Information Technology & Electronic Engineering, 2013, 14(9): 682-700.
Detecting P2P bots by mining the regional periodicity[J]. 信息与电子工程前沿（英文）, 2013,14(9):682-700. DOI： 10.1631/jzus.C1300053.

Yong QIAO, Yue-xiang YANG, Jie HE, et al. Detecting P2P bots by mining the regional periodicity[J]. Frontiers of Information Technology & Electronic Engineering, 2013, 14(9): 682-700. DOI： 10.1631/jzus.C1300053.

摘要

Abstract

Peer-to-peer (P2P) botnets outperform the traditional Internet relay chat (IRC) botnets in evading detection and they have become a prevailing type of threat to the Internet nowadays. Current methods for detecting P2P botnets

such as similarity analysis of network behavior and machine-learning based classification

cannot handle the challenges brought about by different network scenarios and botnet variants. We noticed that one important but neglected characteristic of P2P bots is that they periodically send requests to update their peer lists or receive commands from botmasters in the command-and-control (C & C) phase. In this paper

we propose a novel detection model named detection by mining regional periodicity (DMRP)

including capturing the event time series

mining the hidden periodicity of host behaviors

and evaluating the mined periodic patterns to identify P2P bot traffic. As our detection model is built based on the basic properties of P2P protocols

it is difficult for P2P bots to avoid being detected as long as P2P protocols are employed in their C & C. For hidden periodicity mining

we introduce the so-called regional periodic pattern mining in a time series and present our algorithms to solve the mining problem. The experimental evaluation on public datasets demonstrates that the algorithms are promising for efficient P2P bot detection in the C & C phase.

关键词

Keywords

references

R. Agrawal , , , R. Srikant . . Fast Algorithms for Mining Association Rules . . Proc. 20th Int. Conf. on Very Large Data Bases , , 1994 . . p.487 - - 499 . . . .

E. Athanasopoulos , , , A. Makridakis , , , S. Antonatos , , , D. Antoniades , , , S. Ioannidis , , , K.G. Anagnostakis , , , E.P. Markatos . . Antisocial networks: turning a social network into a botnet . . LNCS , , 2008 . . 5222 146 - - 160 . . DOI: 10.1007/978-3-540-85886-7_10 http://doi.org/10.1007/978-3-540-85886-7_10 . .

G. Bartlett , , , J. Heidemann , , , C. Papadopoulos . . Low-Rate, Flow-Level Periodicity Detection . . IEEE Conf. on Computer Communications Workshops , , 2011 . . p.804 - - 809 . . . .

C. Berberidis , , , W.G. Aref , , , M. Atallah , , , I. Vlahavas , , , A.K. Elmagarmid . . Multiple and Partial Periodicity Mining in Time Series Databases . . European Conf. on Artificial Intelligence , , 2002 . . p.370 - - 374 . . . .

R.N. Bracewell , , , R. Bracewell . . The Fourier Transform and Its Applications , , : : New York McGraw-Hill , , 1986 . . .

L. Cohen . . Convolution, filtering, linear systems, the Wiener-Khinchin theorem: generalizations . . SPIE , , 1992 . . 1770 378 - - 393 . . DOI: 10.1117/12.130944 http://doi.org/10.1117/12.130944 . .

D. Fisher . . Storm, Nugache Lead Dangerous New Botnet Barrage . . Available from SearchSecurity.com , , 2007 . . .

J.B. Grizzard , , , V. Sharma , , , C. Nunnery , , , B.B.H. Kang , , , D. Dagon . . Peer-to-Peer Botnets: Overview and Case Study . . Proc. 1st Conf. on 1st Workshop on Hot Topics in Understanding Botnets , , 2007 . . p.1 . .

G. Gu , , , R. Perdisci , , , J. Zhang , , , W. Lee . . BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection . . USENIX Security Symp. , , 2008 . . p.139 - - 154 . . . .

J. Han , , , G. Dong , , , Y. Yin . . Efficient Mining of Partial Periodic Patterns in Time Series Database . . Proc. 15th IEEE Int. Conf. on Data Engineering , , 1999 . . p.106 - - 115 . . . .

J. Han , , , H. Cheng , , , D. Xin , , , X. Yan . . Frequent pattern mining: current status and future directions . . Data Min. Knowl. Discov. , , 2007 . . 15 ( ( 1 ): ): 55 - - 86 . . DOI: 10.1007/s10618-006-0059-1 http://doi.org/10.1007/s10618-006-0059-1 . .

T. Holz , , , M. Steiner , , , F. Dahl , , , E. Biersack , , , F. Freiling . . Measurements and Mitigation of Peer-to-Peer-Based Botnets: a Case Study on Storm Worm . . USENIX Workshop on Large-Scale Exploits and Emergent Threats , , 2008 . . p.1 - - 9 . . . .

J. Kang , , , Y.Z. Song , , , J.Y. Zhang . . Accurate detection of peer-to-peer botnet using multi-stream fused scheme . . J. Networks , , 2011 . . 6 ( ( 5 ): ): 807 - - 814 . . DOI: 10.4304/jnw.6.5.807-814 http://doi.org/10.4304/jnw.6.5.807-814 . .

J.S. Lee , , , H.C. Jeong , , , J.H. Park , , , M. Kim , , , B.N. Noh . . The Activity Analysis of Malicious HTTP-Based Botnets Using Degree of Periodic Repeatability . . Int. Conf. on Security Technology , , 2008 . . p.83 - - 86 . . DOI: 10.1109/SecTech.2008.52 http://doi.org/10.1109/SecTech.2008.52 . .

Z. Li , , , B. Ding , , , J. Han , , , R. Kays , , , P. Nye . . Mining Periodic Behaviors for Moving Objects . . Proc. 16th ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining , , 2010 . . p.1099 - - 1108 . . DOI: 10.1145/1835804.1835942 http://doi.org/10.1145/1835804.1835942 . .

Z. Li , , , J. Wang , , , J. Han . . Mining Event Periodicity from Incomplete Observations . . Proc. 18th ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining , , 2012 . . p.444 - - 452 . . DOI: 10.1145/2339530.2339604 http://doi.org/10.1145/2339530.2339604 . .

S. Ma , , , J.L. Hellerstein . . Mining Partially Periodic Event Patterns with Unknown Periods . . Proc. 17th IEEE Int. Conf. on Data Engineering , , 2001 . . p.205 - - 214 . . DOI: 10.1109/ICDE.2001.914829 http://doi.org/10.1109/ICDE.2001.914829 . .

M.M. Masud , , , J. Gao , , , L. Khan , , , J. Han , , , B. Thuraisingham . . Mining Concept-Drifting Data Stream to Detect Peer to Peer Botnet Traffic . . Available from , , 2008 . . http://www.utdallas.edu/mmm058000/reports/UTDCS-05-08.pdf http://www.utdallas.edu/mmm058000/reports/UTDCS-05-08.pdf , , . .

P. Maymounkov , , , D. Mazieres . . Kademlia: a Peer-to-Peer Information System Based on the XOR Metric . . Peer-to-Peer Systems , , 2002 . . p.53 - - 65 . . DOI: 10.1007/3-540-45748-8_5 http://doi.org/10.1007/3-540-45748-8_5 . .

A. Nappa , , , A. Fattori , , , M. Balduzzi , , , M. Dell'amico , , , L. Cavallaro . . Take a Deep Breath: a Stealthy, Resilient and Cost-Effective Botnet Using Skype. In : Kreibich, C.J.M. (Ed.), Detection of Intrusions and Malware, and Vulnerability Assessment . . Springer Berlin Heidelberg , , 2010 . . p.81 - - 100 . . DOI: 10.1007/978-3-642-14215-4_5 http://doi.org/10.1007/978-3-642-14215-4_5 . .

S.K. Noh , , , J.H. Oh , , , J.S. Lee , , , B.N. Noh , , , H.C. Jeong . . Detecting P2P Botnets Using a Multi-phased Flow Model . . IEEE 3rd Int. Conf. on Digital Societ , , 2009 . . p.247 - - 253 . . DOI: 10.1109/ICDS.2009.37 http://doi.org/10.1109/ICDS.2009.37 . .

R. Perdisci , , , G. Gu , , , W. Lee . . Using an Ensemble of One-Class SVM Classifiers to Harden Payload-Based Anomaly Detection Systems . . IEEE 6th Int. Conf. on Data Mining , , 2006 . . p.488 - - 498 . . DOI: 10.1109/ICDM.2006.165 http://doi.org/10.1109/ICDM.2006.165 . .

Y. Qiao , , , Y. Yang , , , J. He , , , B. Liu , , , Y. Zeng . . Detecting parasite P2P botnet in eMule-like networks through quasi-periodicity recognition . . LNCS , , 2012 . . 7259 127 - - 139 . . DOI: 10.1007/978-3-642-31912-9_9 http://doi.org/10.1007/978-3-642-31912-9_9 . .

S. Saad , , , I. Traore , , , A. Ghorbani , , , B. Sayed , , , D. Zhao , , , W. Lu , , , J. Felix , , , P. Hakimian . . Detecting P2P Botnets Through Network Behavior Analysis and Machine Learning . . IEEE 9th Annual Int. Conf. on Privacy, Security and Trust , , 2011 . . p.174 - - 180 . . DOI: 10.1109/PST.2011.5971980 http://doi.org/10.1109/PST.2011.5971980 . .

C. Sheng , , , W. Hsu , , , M.L. Lee . . Mining Dense Periodic Patterns in Time Series Data . . Proc. 22nd Int. Conf. on Data Engineering , , 2006 . . p.115 DOI: 10.1109/ICDE.2006.97 http://doi.org/10.1109/ICDE.2006.97 . .

G. Starnberger , , , C. Kruegel , , , E. Kirda . . Overbot: a Botnet Protocol Based on Kademlia . . Proc. 4th Int. Conf. on Security and Privacy in Communication Networks , , 2008 . . Article 13 DOI: 10.1145/1460877.1460894 http://doi.org/10.1145/1460877.1460894 . .

R. Villamarin-Salomon , , , J.C. Brustoloni . . Bayesian Bot Detection Based on DNS Traffic Similarity . . Proc. ACM Symp. on Applied Computing , , 2009 . . p.2035 - - 2041 . . DOI: 10.1145/1529282.1529734 http://doi.org/10.1145/1529282.1529734 . .

R. Vogt , , , J. Aycock , , , M.J.Jr Jacobson . . Army of Botnets . . Network and Distributed System Security Symp. , , 2007 . . p.111 - - 123 . . . .

P. Wang , , , B. Aslam , , , C.C. Zou . . Peer-to-Peer Botnets. In : Handbook of Information and Communication Security . . Springer , , 2010a . . p.335 - - 350 . . . .

P. Wang , , , S. Sparks , , , C.C. Zou . . An advanced hybrid peer-to-peer botnet . . IEEE Trans. Depend. Secur. Comput. , , 2010b . . 7 ( ( 2 ): ): 113 - - 127 . . DOI: 10.1109/TDSC.2008.35 http://doi.org/10.1109/TDSC.2008.35 . .

J. Yang , , , W. Wang , , , P.S. Yu . . Mining asynchronous periodic patterns in time series data . . IEEE Trans. Knowl. Data Eng. , , 2003 . . 15 ( ( 3 ): ): 613 - - 628 . . DOI: 10.1109/TKDE.2003.1198394 http://doi.org/10.1109/TKDE.2003.1198394 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Effect of chip rate on the ranging accuracy in a regenerative pseudo-noise ranging system