Facial reconstruction

Search LJMU Research Online

Browse Repository | Browse E-Theses

Analysis and Characterization of Botnet Scan Traffic

Marnerides, A and Mauthe, A (2016) Analysis and Characterization of Botnet Scan Traffic. In: 2016 International Conference on Computing, Networking and Communications (ICNC) . pp. 1-7. (IEEE International Conference on Computing, Networking and Communications (ICNC) 2016, 15 February 2016 - 18 February 2016, Kauai, HI, USA).

[img] Text
ICNC_2016_botnets_crc.pdf - Accepted Version

Download (702kB)

Abstract

Botnets compose a major source of malicious activity over a network and their early identification and detection is considered as a top priority by security experts. The majority of botmasters rely heavily on a scan procedure in order to detect vulnerable hosts and establish their botnets via a command and control (C&C) server. In this paper we examine the statistical characteristics of the scan process invoked by the Mariposa and Zeus botnets and demonstrate the applicability of conditional entropy as a robust metric for profiling it using real pre-captured operational data. Our analysis conducted on real datasets demonstrates that the distributional behaviour of conditional entropy for Mariposa and Zeus-related scan flows differs significantly from flows manifested by the commonly used NMAP scans. In contrast with the typically used by attackers Stealth and Connect NMAP scans, we show that consecutive scanning flows initiated by the C&C servers of the examined botnets exhibit a high dependency between themselves in regards of their conditional entropy. Thus, we argue that the observation of such scan flows under our proposed scheme can sufficiently aid network security experts towards the adequate profiling and early identification of botnet activity.

Item Type: Conference or Workshop Item (Paper)
Subjects: Q Science > QA Mathematics > QA75 Electronic computers. Computer science
Q Science > QA Mathematics > QA76 Computer software
Divisions: Computer Science
Publisher: IEEE
Date Deposited: 13 Jan 2016 15:03
Last Modified: 31 Mar 2016 09:37
URI: http://researchonline.ljmu.ac.uk/id/eprint/2589

Actions (login required)

View Item View Item