Advertisement
Published in:
2009 | OriginalPaper | Chapter
Anomaly-Based Detection of IRC Botnets by Means of One-Class Support Vector Classifiers
Authors : Claudio Mazzariello, Carlo Sansone
Published in: Image Analysis and Processing – ICIAP 2009
Publisher: Springer Berlin Heidelberg
Activate our intelligent search to find suitable subject content or patents.
Select sections of text to find matching patents with Artificial Intelligence. powered by
Select sections of text to find additional relevant content using AI-assisted search. powered by
The complexity of modern cyber attacks urges for the definition of detection and classification techniques more sophisticated than those based on the well known
signature detection
approach. As a matter of fact, attackers try to deploy armies of controlled
bots
by infecting vulnerable hosts. Such bots are characterized by complex executable command sets, and take part in cooperative and coordinated attacks. Therefore, an effective detection technique should rely on a suitable model of both the envisaged networking scenario and the attacks targeting it.
We will address the problem of detecting
botnets
, by describing a behavioral model, for a specific class of network users, and a set of features that can be used in order to identify
botnet
-related activities. Tests performed by using an anomaly-based detection scheme on a set of real network traffic traces confirmed the effectiveness of the proposed approach.