Background
Anomaly detection techniques
Flow-based methods for botnet detection
Limitation
Graph-based methods for botnet detection
Limitation
Significance of our approach
-
We present a novel graph-based method for the detection of botnets in a computer network.
-
Our approach does not depend on any rules to detect botnets and is capable of capturing the changing behavior of bots.
-
Seven graph based features are used to characterize the topological structure of the network and utilize them to detect botnets.
-
The proposed method can detect different types of botnets with different types of behavioral characteristics.
-
A real world dataset is used to validate the results.
Data description
-
Dataset must have real botnet attacks, not simulated attacks.
-
Must have real world traffic.
-
Must have ground truth labels for training and evaluating methods discussed in [73].
-
Must include multiple types of botnets.
-
Must have several bots infected simultaneously to capture synchronization patterns.
-
Must have NetFlow files to protect the privacy of the users.
Dataset | Duration (h) | NetFlows | Size (GB) | Bot name | Number of bots | Botnet flow |
---|---|---|---|---|---|---|
1 | 6.15 | 2,824,637 | 52 | Neris | 1 | 39933 (1.41%) |
2 | 4.21 | 1,808,123 | 60 | Neris | 1 | 18839 (1.04%) |
3 | 66.85 | 4,710,639 | 121 | Rbot | 1 | 26759 (0.56%) |
4 | 4.21 | 1,121,077 | 53 | Rbot | 1 | 1719 (0.15%) |
5 | 11.63 | 129,833 | 37.6 | Virut | 1 | 695 (0.53%) |
6 | 2.18 | 558,920 | 30 | Menti | 1 | 4431 (0.79%) |
7 | 0.38 | 114,078 | 5.8 | Sogou | 1 | 37 (0.03%) |
8 | 19.5 | 2,954,231 | 123 | Murlo | 1 | 5052 (0.17%) |
9 | 5.18 | 2,753,885 | 94 | Neris | 10 | 179880 (6.5%) |
10 | 4.75 | 1,309,792 | 73 | Rbot | 10 | 106315 (8.11%) |
11 | 0.26 | 107,252 | 5.2 | Rbot | 3 | 8161 (7.6%) |
12 | 1.21 | 325,472 | 8.3 | NSIS.ay | 3 | 2143 (0.65%) |
13 | 16.36 | 1,925,150 | 34 | Virut | 1 | 38791 (2.01%) |
Proposed graph based clustering
Graph features
In degree
Out degree
In degree weight
Out degree weight
Node betweenness centrality
Local clustering coefficient
Eigen vector centrality
Self organizing map
Case study-detecting bots in CTU-13
Graph features extraction
1 | 2 | 3 | 4 | 5 | 6 | 7 |
---|---|---|---|---|---|---|
In degree | Out degree | Sum of ingoing edges weight | Sum of outgoing edges Weight | Clustering coefficient | Node betweenness | Eigen vector |
Graph based botnet detection using clustering
Dataset | No. of nodes | No. of nodes in the biggest cluster | % of nodes to be eliminated for bot detection |
---|---|---|---|
1 | 311,420 | 309,741 | 99.4608 |
2 | 442,471 | 440,505 | 99.5556 |
3 | 434,988 | 433,852 | 99.7388 |
4 | 186,245 | 185,042 | 99.3540 |
5 | 41,658 | 40,874 | 98.1180 |
6 | 107,343 | 105,672 | 98.4433 |
7 | 38,205 | 37,260 | 97.5265 |
8 | 383,788 | 382,670 | 99.7086 |
9 | 367,264 | 366,271 | 99.7296 |
10 | 197,824 | 196,996 | 99.5814 |
11 | 41,933 | 40,603 | 96.8282 |
12 | 94,436 | 93,104 | 98.5895 |
13 | 315,769 | 313,326 | 99.2263 |
Dataset | Number of bots | Number of identified bots | Size of the bot cluster | Ns
| % of nodes to search |
---|---|---|---|---|---|
1 | 1 | 1 | 27 | 120 | 0.038 |
2 | 1 | 1 | 12 | 41 | 0.009 |
3 | 1 | 1 | 26 | 125 | 0.028 |
4 | 1 | 1 | 40 | 238 | 0.127 |
5 | 1 | 1 | 6 | 26 | 0.062 |
6 | 1 | 1 | 38 | 163 | 0.151 |
7 | 1 | 1 | 11 | 44 | 0.115 |
8 | 1 | 1 | 184 | 563 | 0.146 |
9 | 10 | 3 | 21 | 73 | 0.019 |
7 | 40 | 63 | 0.017 | ||
10 | 10 | 10 | 20 | 90 | 0.045 |
11 | 3 | 2 | 9 | 24 | 0.057 |
1 | 770 | 1306 | 3.114 | ||
12 | 3 | 2 | 11 | 53 | 0.056 |
1 | 19 | 60 | 0.063 | ||
13 | 1 | 1 | 16 | 64 | 0.020 |
Enhanced bot detection via filtering
Dataset | Botnet detection without filtering | Botnet detection without filtering | ||
---|---|---|---|---|
N
s
| % of nodes to search |
N
s
| % of nodes to search | |
1 | 120 | 0.038 | 115 | 0.036 |
3 | 125 | 0.028 | 96 | 0.022 |
4 | 238 | 0.127 | 181 | 0.097 |
5 | 26 | 0.062 | 65 | 0.156 |
6 | 163 | 0.151 | 252 | 0.234 |
7 | 44 | 0.115 | 40 | 0.104 |
8 | 563 | 0.146 | 307 | 0.079 |
10 | 90 | 0.045 | 77 | 0.038 |
11 | 24 | 0.057 | 21 | 0.050 |
1306 | 3.114 | 384 | 0.915 | |
12 | 53 | 0.056 | 36 | 0.038 |
60 | 0.063 |
Benchmark against classification
Testing dataset | Actual bot | Detected bot | |
---|---|---|---|
Training scenario: 9 | Training scenario: 10 | ||
1 | 1 | 0 | 0 |
2 | 1 | 1 | 1 |
3 | 1 | 0 | 0 |
4 | 1 | 0 | 0 |
5 | 1 | 0 | 0 |
6 | 1 | 0 | 0 |
7 | 1 | 0 | 0 |
8 | 1 | 0 | 0 |
11 | 3 | 0 | 0 |
12 | 3 | 0 | 0 |
13 | 1 | 0 | 0 |