Botnet detection based on network flow analysis using inverse statistics

Author(s)

Lopes, Daniele A. G. ; Marotta, Marcelo A. ; Ladeira, Marcelo ; Gondim, Joao J. C. ; Rocha, A ; Bordel, B ; Penalvo, FG ; Goncalves, R

• Document type: Journal article
• Source: 2022 17TH IBERIAN CONFERENCE ON INFORMATION SYSTEMS AND TECHNOLOGIES (CISTI); v. N/A, p. 6-pg., 2022-01-01.

Abstract

A botnet is a network of infected computers, which are remotely controlled by a cybercriminal, called botmaster, which aims to carry out massive cyberattacks, such as DDoS, SPAM, and information theft. Traditional botnet detection methods, usually signature-based, are unable to detect unknown botnets. The behavior-based analysis is promising for detecting current botnet trends, which are constantly evolving. This article proposes an exploration analysis of botnet detection mechanisms based on the network flow behavior. The main technique used to detect botnets was recently developed and is called Energy-based Flow Classifier (EFC). This technique uses inverse statistics to detect anomalies. Two heterogeneous datasets, CTU-13 and ISOT HTTP were used to evaluate the efficiency of the generated model and the results were compared with several traditional classifiers, of one and two classes. The results obtained show that EFC obtained more stable results, regardless of the domain, unlike the other tested algorithms. (AU)

• FAPESP's process: 20/05152-7 - PROFISSA: Programmable Future Internet for Secure Software Architectures
• Grantee: Lisandro Zambenedetti Granville
• Support Opportunities: Research Projects - Thematic Grants