BotSpot: fast graph based identification of structured P2P bots
BotSpot: fast graph based identification of structured P2P bots
复制标题
DOI：
10.1007/s11416-015-0250-2
复制
发表时间：
2015-09
影响因子：
1.5
通讯作者：
Bharath Venkatesh;S. Choudhury;Shishir Nagaraja;N. Balakrishnan
中科院分区：
文献类型：
--
作者：
Bharath Venkatesh;S. Choudhury;Shishir Nagaraja;N. Balakrishnan
僵尸网络的一个重要组成部分是命令和控制（C2）通道（网络）。C2建立的机制通常涉及使用结构化覆盖技术，为复杂的协调活动创建一个脚手架。然而，它也可以用作检测点，因为它们的通信模式不同。实现这一点是一个大海捞针的搜索问题，在分布式的Vantage点。由于现代核心路由器的高流量吞吐量，搜索技术必须高效。在本文中，我们专注于C2信道检测的有效算法。从ISP的骨干网络上的真实的互联网流量痕迹的实验结果表明，我们的技术，（i）有时间复杂度的流量的线性，（ii）有高的F-措施，（iii）arrobustto部分可见性所产生的部分部署的监控系统，和测量不准确性所产生的部分可见性和动态的背景流量。
An essential component of a botnet is the Command and Control (C2) channel (a network). The mechanics of C2 establishment often involve the use of structured overlay techniques which create a scaffolding for sophisticated coordinated activities. However, it can also be used as a point of detection because of their distinct communication patterns. Achieving this is a needle-in-a-haystack search problem across distributed vantage points. The search technique must beefficientgiven the high traffic throughput of modern core routers. In this paper, we focus on efficient algorithms for C2 channel detection. Experimental results on real Internet traffic traces from an ISP’s backbone network indicate that our techniques, (i) have time complexity linear in the volume of traffic, (ii) have high F-measure, and (iii) arerobustto the partial visibility arising from partial deployment of monitoring systems, and measurement inaccuracies arising from partial visibility and dynamics of background traffic.