Botnet Detection using NetFlow and Clustering

Pedram Amini, Reza Azmi, MuhammadAmin Araghizadeh

Abstract


Among the various forms of malware, botnets are becoming the major threats on the Internet that use for many attacks, such as spam, distributed denial-of-service (DDoS), identity theft and phishing. NetFlow protocol is a standard for monitoring Internet traffic that developed by Cisco Systems. Therefore, it is very effective to identifying unusual programs generating illegal traffic, or additional load, and also identification of botnet. The main goal of this paper is to show a novel approach for botnet detection using data records of NetFlow protocol and clustering technique. Our approach for C and C bot detection is to examine flow characteristics such as IP, port, packet event times and bytes per packet for evidence of botnet activity. First we collect the flows and refined records based on basic filtering, white list and black list. The remaining records produce a cluster and the cluster refined based on patterns, policies, and another cluster that generated based on reported events, alerts and activities of network security sensors. We apply hierarchical clustering that allows us to build a dendrogram, i.e., a tree like graph that encodes the relationships among the bots. The merged cluster modifies based on rules and combined with other information about detected infected nodes to reduce false positive.

Keywords


NetFlow Protocol; C and C Botnet; Hierarchical Clustering; Correlation; Anomaly Detection; Network Security

Full Text:

PDF


Lululemon Black Friday cheap nfl jerseys Lululemon factory Outlet ny Black Friday discount tiffany outlet wholesale soccer jerseys online oakley black friday cheap nhl jerseys china cheap nfl jerseys north face black friday sale cheap nfl jerseys online Jordans Black Friday Sale 2015 Cheap Moncler Cyber Monday moncler outlet cheap soccer jerseys moncler outlet black friday cheap authentic nfl jerseys north face cyber monday Louboutin Black Friday canada wholesale cheap nfl jerseys lululemon cyber monday 2015 cheap nfl jerseys from china 2015 Cheap Moncler Black Friday Sale Moncler Cyber Monday 2015 cheap jerseys Lululemon Cyber Monday Sale jordans cyber monday deals 2015 Black Friday deals Lululemon 2015 jordan black friday 2015 Moncler Jackets Black Friday Sale 2015 Louboutin Pas Cher Black Friday 2015 Canada Lululemon north face black friday cheap wholesale soccer jerseys