Correlation-based Botnet Detection in Enterprise Networks

Malware detection;Network security;Anomaly detection;Intrusion detection

Gu, Guofei ; Computing

University:Georgia Institute of Technology

Department:Computing

关键词: Malware detection;    Network security;    Anomaly detection;    Intrusion detection;   

Others  :  https://smartech.gatech.edu/bitstream/1853/24634/1/gu_guofei_200808_phd.pdf

美国|英语

来源: SMARTech Repository

【 摘 要 】

Most of the attacks and fraudulent activities on the Internet are carried out by malware. In particular, botnets, as state-of-the-art malware, are now considered as the largest threat to Internet security. In this thesis, we focus on addressing the botnet detection problem in an enterprise-like network environment. We present a comprehensive correlation-based framework for multi-perspective botnet detection consisting of detection technologies demonstrated in four complementary systems: BotHunter, BotSniffer, BotMiner, and BotProbe. The common thread of these systems is correlation analysis, i.e., vertical correlation (dialog correlation), horizontal correlation, and cause-effect correlation. All these Bot* systems have been evaluated in live networks and/or real-world network traces. The evaluation results show that they can accurately detect real-world botnets for their desired detection purposes with a very low false positive rate. We find that correlation analysis techniques are of particular value for detecting advanced malware such as botnets. Dialog correlation can be effective as long as malware infections need multiple stages. Horizontal correlation can be effective as long as malware tends to be distributed and coordinated. In addition, active techniques can greatly complement passive approaches, if carefully used. We believe our experience and lessons are of great benefit to future malware detection.