Abstract
Botnets have become one of the most significant cyber threat over the last decade. The diffusion of the “Internet of Things” and its for-profit exploitation, contributed to botnets spread and sophistication, thus providing real, efficient and profitable criminal cyber-services. Recent research on botnet detection focuses on traffic pattern-based detection, analyzing the network traffic generated by the infected hosts, in order to find malicious behaviors regardless of the specific payload, architecture and protocol. In this chapter, we address the periodic behavior of infected hosts communicating with their Command-and-Control (C2) servers. We introduce an effective, fast and scalable approach based on the layer-5 traffic analysis in the frequency domain, without using the well-known Fast Fourier Transform. The mentioned analysis has been performed exploiting the logs of a wide corporate network and tested on real malware samples, in order to demonstrate its applicability almost in every practical scenario.
A preliminary version of this chapter was presented at the 9th International Conference on Security of Information and Networks (SIN 2016) (Bottazzi et al. 2016).
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
AsSadhan, B., & Moura, J. M. F. (2014). An efficient method to detect periodic behavior in botnet traffic by analyzing control plane traffic. Journal of Advanced Research, 5, 435–448.
AsSadhan, B., et al. (2009a). Detecting botnets using command and control traffic. Network Computing and Applications, 2009. NCA 2009. 8th IEEE International symposium on. IEEE.
AsSadhan, B., Moura, J. M. F., & Lapsley, D. (2009b, November 30–December 4). Periodic behavior in botnet command and control channels traffic. In Proceedings of IEEE Global Communications conference (IEEE GLOBECOM 2009). Honolulu.
Balram, S., & Wilscy, M. (2014). User traffic profile for traffic reduction and effective bot C&C detection. International Journal of Network Security, 16(1), 46–52.
Bartlett, G. et al. (2011, April 10–15). Low-rate, flow-level periodicity detection. In Proceedings of the 30th IEEE International Conference on Computer Communications (IEEE INFOCOM 2011), Shanghai.
Bottazzi, G., & Italiano, G. F. (2015). Fast mining of large-scale logs for botnet detection: A field study. In Proceedings of the 3rd IEEE international workshop on Cybercrimes and Emerging Web Environments, in conjunction with the 13th IEEE international conference on dependable, autonomic and secure computing, At Liverpool, UK.
Bottazzi, G., et al. (2015). MP-shield: A framework for phishing detection in mobile devices. In Proceedings of the 3rd IEEE international workshop on Cybercrimes and Emerging Web Environments, Liverpool, UK.
Bottazzi, G., Italiano, G. F., & Rutigliano, G. G. (2016, July 20–22). Frequency domain analysis of large-scale proxy logs for botnet traffic detection. In Proceedings of the 9th international conference on Security of Information and Networks (SIN ‘16), Rutgers University, New Jersey.
Chimetseren, E., Iwai, K., Tanaka, H., & Kurokawa, T. (2014, October 15–17). A study of IDS using discrete Fourier transform. In Proceedings of international conference on Advanced Technologies for Communications, ATC, Hanoi.
Eslahi, M., et al. (2015). Periodicity classification of HTTP traffic to detect HTTP botnets. In Proceedings IEEE Symposium on Computer Applications & Industrial Electronics (ISCAIE 2015), Langkawi.
Falliere, N. (2011). Sality: Story of a peer-to-peer viral network (Technical Report by Symantec Labs).
Giuseppini, G., Burnett, M., Faircloth, J., & Kleiman, D. (2015). Microsoft log parser toolkit: A complete toolkit for Microsoft’s undocumented log analysis tool. ISBN-13: 978–1932266528.
Gu, G., Zhang, J., & Lee, W. (2008a). Botsniffer: Detecting botnet command and control channels in network traffic. NDSS.
Gu, G., Perdisci, R., Zhang, J., Lee, W., et al. (2008b). Botminer: Clustering analysis of network traffic for protocol-and structure-independent botnet detection (USENIX Security Symposium, pp 139–154).
Heideman, M. T., Don, H., & Johnson, C. (1984). Sidney Burrus, Gauss and the History of the Fast Fourier Transform. IEEE ASSP Magazine.
Herley, C., & Florencio, D. (2009). Nobody sells gold for the price of silver: Dishonesty, uncertainty and the underground economy (Microsoft TechReport).
Kwon, J., Kim, J., Lee, J., Lee, H., & Perrig, A. (2014). PsyBoG: Power spectral density analysis for detecting botnet groups. In Proceedings of the 9th IEEE international conference on Malicious and Unwanted Software, MALCON.
Kwon, J., Kim, J., Lee, J., Lee, H., & Perrig, A. (2016). PsyBoG: A scalable botnet detection method for large-scale DNS traffic. Computer Networks, 97, 48–73.
MIT Staff. (2012). SFFT: Sparse fast Fourier transform. http://groups.csail.mit.edu/netmit/sFFT/index.html.
Ogu, E. C., Vrakas, N., Chiemela, O., & Ajose-Ismail, B. M. (2016). On the internal workings of botnets: A review. International Journal of Computer Applications, 138(4).
Paul, T., et al. (2014). Fast-flux botnet detection from network traffic. India Conference (INDICON), 2014 annual IEEE. IEEE.
Rossow, C., et al. (2013). P2PWNED: Modeling and evaluating the resilience of peer-to-peer botnets. In Proceedings of the 2013 IEEE symposium on Security and Privacy (SP 2013), San Francisco.
Sood, A. K., & Bansal, R. (2014). Prosecting the citadel botnet – Revealing the dominance of the Zeus descendent, Kaspersky Virus Bulletin.
Stratosphere IPS Project. https://stratosphereips.org/.
Tegeler, F., Xiaoming, F., Vigna, G., & Kruegel, C. (2012). BotFinder: Finding bots in network traffic without deep packet inspection. In Proceedings of the 8th international conference on Emerging Networking Experiments and Technologies (CoNEXT ‘12).
Thaker, K. S. (2015). Modelling and detection of camouflaging worm at an advance level. International Journal of Advanced Research in Computer Science and Software Engineering, 5(10), 758–762.
Tsuge, Y., & HidemaTanaka. (2016). Intrusion detection system using discrete Fourier Transform with window function. International Journal of Network Security & Its Applications (IJNSA), 8(2), 23–34.
Yu, X., Dong, X., Yu, G., Qin, Y., Yue, D., & Zhao, Y. (2010). Online botnet detection based on incremental discrete Fourier transform. Journal of Networks, 5(5), 568–576.
Zhao, D., Traore, I., Sayed, B., Lu, W., Saad, S., Ghorbani, A., & Garant, D. (2013). Botnet detection based on traffic behavior analysis and flow intervals. Computers and Security, 39, 2–16.
Zhou, M., & Lang, S.-D. (2003). Mining frequency content of network traffic for intrusion detection. In Proceedings of the IASTED international conference on communication, network, and information security.
Zhou, M., & Lang, S.-D. (2004). A frequency-based approach to intrusion detection. Journal of Systemics, Cybernetics and Informatics, 2(3), 52–56.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this chapter
Cite this chapter
Bottazzi, G., Italiano, G.F., Rutigliano, G.G. (2018). A New Scalable Botnet Detection Method in the Frequency Domain. In: Jahankhani, H. (eds) Cyber Criminology. Advanced Sciences and Technologies for Security Applications. Springer, Cham. https://doi.org/10.1007/978-3-319-97181-0_7
Download citation
DOI: https://doi.org/10.1007/978-3-319-97181-0_7
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-97180-3
Online ISBN: 978-3-319-97181-0
eBook Packages: Law and CriminologyLaw and Criminology (R0)