A Taxonomy of Botnet Behavior, Detection, and Defense
A Taxonomy of Botnet Behavior, Detection, and Defense
复制标题
DOI：
10.1109/surv.2013.091213.00134
复制
发表时间：
2014-01
影响因子：
35.6
通讯作者：
Sheharbano Khattak;Naurin Rasheed;K. Khan;A. Syed;S. A. Khayam
中科院分区：
文献类型：
--
作者：
Sheharbano Khattak;Naurin Rasheed;K. Khan;A. Syed;S. A. Khayam
过去十年中出现了许多检测和防御机制来应对僵尸网络现象。整理这些知识对于更好地理解僵尸网络问题及其解决方案空间非常重要。在本文中，我们将现有的僵尸网络文献构建为僵尸网络行为特征、检测和防御的三个综合分类法。这种崇高的观点通过揭示现有方法的缺陷来强调网络防御的机会。我们引入维度的概念来表示可用于对僵尸网络检测技术进行分类的不同标准。我们证明，按维度分类对于通过各种感兴趣的指标评估僵尸网络检测机制特别有用。我们还展示了第一个分类中的僵尸网络行为特征如何影响第二个分类中检测方法的准确性。该信息可用于通过结合互补方法来设计综合检测策略。为了提供真实世界的背景，我们通过安全研究和产品的相关示例自由地扩大我们的讨论。
A number of detection and defense mechanisms have emerged in the last decade to tackle the botnet phenomenon. It is important to organize this knowledge to better understand the botnet problem and its solution space. In this paper, we structure existing botnet literature into three comprehensive taxonomies of botnet behavioral features, detection and defenses. This elevated view highlights opportunities for network defense by revealing shortcomings in existing approaches. We introduce the notion of a dimension to denote different criteria which can be used to classify botnet detection techniques. We demonstrate that classification by dimensions is particularly useful for evaluating botnet detection mechanisms through various metrics of interest. We also show how botnet behavioral features from the first taxonomy affect the accuracy of the detection approaches in the second taxonomy. This information can be used to devise integrated detection strategies by combining complementary approaches. To provide real-world context, we liberally augment our discussions with relevant examples from security research and products.