Skip to main content
SpringerLink
Log in

Unsupervised Learning: Using Clustering Algorithms to Detect Peer to Peer Botnet Flows

  • Conference paper
  • First Online:
Security with Intelligent Computing and Big-Data Services 2019 (SICBS 2019)

Part of the book series: Advances in Intelligent Systems and Computing ((AISC,volume 1145))

  • 342 Accesses

Abstract

The war against botnet infection is fought every day by users that want to feel safe against any threat of compromise hosts. In this paper we are going to focus on the behavior of Peer 2 Peer (P2P) botnets, which along with hybrid botnets is a growing trend among attackers. The main approach will consist of a behavior comparison among features extracted from network flows, focusing only in the flows from P2P applications including P2P botnets.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 129.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 169.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Price, R.: Business Insider, 28 May 2015. http://www.businessinsider.com/hola-used-for-botnet-on-chrome-2015-5. Accessed 6 June 2015

  2. Kaspersky Lab: SecureList. Kaspersky, 29 May 2015. https://securelist.com/blog/research/70071/statistics-on-botnet-assisted-ddos-attacks-in-q1-2015/. Accessed 6 June 2015

  3. Barthakur, P., Dahal, M., Ghose, M.K.: A framework for P2P botnet detection using SVM. In: International Conference on Cyber-Enabled Distributed Computing and Knowledge Discover, Sanya (2012)

    Google Scholar 

  4. Liao, W.H., Chang, C.C.: Peer to peer botnet detection using data mining scheme. In: 2010 International Conference on Internet Technology and Applications, Wuhan (2010)

    Google Scholar 

  5. eMule: eMule Project. http://www.emule-project.net/home/perl/general.cgi?l=1. Accessed 7 June 2015

  6. Skype: Skype. Microsoft. https://support.skype.com/en/faq/FA10983/what-are-p2p-communications. Accessed 7 June 2015

  7. BitTorrent: BitTorrent. BitTorrent Inc. http://www.bittorrent.com/. Accessed 7 June 2015

  8. Wang, P., Aslam, B., Zou, C.C.: Peer-to-peer botnets. In: Handbook of Information and Communication Security, pp. 335–350. Springer, Heidelberg (2010)

    Google Scholar 

  9. Vacca, J.: Computer and Information Security Handbook. Morgan Kaufmann, Burlington (2009)

    Google Scholar 

  10. Narang, P.: PeerShark: flow-clustering and conversation-generation for malicious peer-to-peer traffic identification. EURASIP J. Inf. Secur. (2014)

    Google Scholar 

  11. Symantec Security Response: Zeus Now Setting its Sights on Japanese Online Banking Customers. Symantec, 11 February 2013. http://www.symantec.com/connect/blogs/zeus-now-setting-its-sights-japanese-online-banking-customers. Accessed 7 June 2015

  12. Lelli, A.: Symantec Official Blog. Symantec, 12 January 2011. http://www.symantec.com/connect/blogs/return-dead-waledacstorm-botnet-back-rise. Accessed 7 June 2015

  13. Neville, A.: Symantec Official Blog. Symantec, 4 June 2013. http://www.symantec.com/connect/blogs/waledac-reloaded-trojanrloaderb. Accessed 7 June 2015

  14. Ghahramani, Z.: Unsupervised learning. In: Advanced Lectures on Machine Learning, pp. 72–112. Springer, Berlin (2004)

    Google Scholar 

  15. Hochbaum, D.S., Shmoys, D.B.: A best possible heuristic for the k-center problem. Math. Oper. Res. 10(2), 180–184 (1985)

    Article  MathSciNet  Google Scholar 

  16. Tan, P.N., Steinbach, M., Kumar, V.: Cluster analysis: basic concepts and algorithms. In: Introduction to Data Mining, pp. 487–559. Pearson (2005)

    Google Scholar 

  17. Li, J., Zhang, S., Lu, Y., Yan, J.: Real-time P2P traffic identification. In: Global Telecommunications Conference, New Orleans (2008)

    Google Scholar 

  18. Gu, G., Perdisci, R., Zhang, J., Lee, W.: Botminer: clustering analysis of network traffic for protocol-and structure-independent botnet detection. In: USENIX Security Symposium (2008)

    Google Scholar 

  19. Garg, S., Singh, A.K., Sarje, A.K., Peddoju, S.K.: Behaviour analysis of machine learning algorithms. In: 15th International Conference on Advanced Computing Technologies (ICACT) (2013)

    Google Scholar 

  20. Guntuku, S.C., Narang, P., Hota, C.: Real-time peer-to-peer botnet detection framework based on Bayesian regularized neural network (2013)

    Google Scholar 

  21. Rahbarinia, B., Perdisci, R., Lanzi, A., Li, K.: PeerRush: mining for unwanted P2P traffic. In: Detection of Intrusions and Malware, and Vulnerability Assessment, vol. 7967, pp. 62–82. Springer, Heidelberg (2013)

    Google Scholar 

  22. NETMATE: netmate-flowcalc. https://code.google.com/p/netmate-flowcalc/. Accessed 1 May 2015

  23. Hall, M., Frank, E., Holmes, G., Pfahringer, B., Reutemann, P., Witten, I.H.: The WEKA data mining software: an update. In: SIGKDD Explorations (2009)

    Google Scholar 

Download references

Acknowledgment

This research was partially supported by the Ministry of Science and Technology of the Republic of China under the Grants MOST 108-2218-E-007-053 and MOST 108-2218-E001-001.

Author information

Authors and Affiliations

  1. Department of Computer Science, National Tsing Hua University, Hsinchu, Taiwan

    Andrea E. Medina Paredes & Hung-Min Sun

Authors
  1. Andrea E. Medina Paredes
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Hung-Min Sun
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Hung-Min Sun .

Editor information

Editors and Affiliations

  1. University of Technology Sydney, Broadway, NSW, Australia

    Lakhmi C. Jain

  2. CSIE Department, National Dong Hwa University, Hualien City, Taiwan

    Sheng-Lung Peng

  3. Central Police University, Taoyuan City, Taiwan

    Shiuh-Jeng Wang

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Paredes, A.E.M., Sun, HM. (2020). Unsupervised Learning: Using Clustering Algorithms to Detect Peer to Peer Botnet Flows. In: Jain, L., Peng, SL., Wang, SJ. (eds) Security with Intelligent Computing and Big-Data Services 2019. SICBS 2019. Advances in Intelligent Systems and Computing, vol 1145. Springer, Cham. https://doi.org/10.1007/978-3-030-46828-6_26

Download citation

Publish with us

Policies and ethics

Search

Navigation