Detection of Botnet Command and Control Traffic by the Multistage Trust Evaluation of Destination Identifiers

EAI Endorsed Transactions on Security and Safety

Marcel E.M. Spruit¹  Pieter Burghouwt²  Henk J. Sips³ 

[1] [e-mail];Parallel and Distributed Systems Group, Delft University of Technology, Mekelweg 4, Delft 2628CD, The Netherlands;Research Group Cyber Security and Safety, The Hague University of Applied Sciences, Johanna Westerdijkplein 75, The Hague 2521EN, The Netherlands;

关键词: Botnets;    Network Intrusion Detection;    Anomaly Detection;   

DOI  :  10.4108/eai.5-10-2015.150476

来源: DOAJ

【 摘 要 】

Network-based detection of botnet Command and Control communication is a difficult task if the traffic has a relatively low volume and if popular protocols, such as HTTP, are used to resemble normal traffic. We present a new network-based detection approach that is capable of detecting this type of Command and Control traffic in an enterprise network by estimating the trustworthiness of the traffic destinations. If the destination identifier of a traffic flow origins directly from: human input, prior traffic from a trusted destination, or a defined set of legitimate applications, the destination is trusted and its associated traffic is classified as normal. Advantages of this approach are: the ability of zero day malicious traffic detection, low exposure to malware by passive host-external traffic monitoring, and the applicability for real-time filtering. Experimental evaluation demonstrates successful detection of diverse types of Command and Control Traffic.

【 授权许可】

Unknown