Abstract:In recent years, the botnets have been the most common threats to network security since it exploits multiple malicious codes like a worm, Trojans, Rootkit, etc. The botnets have been used to carry phishing links, to perform attacks and provide malicious services on the internet. It is challenging to identify Peer-to-peer (P2P) botnets as compared to Internet Relay Chat (IRC), Hypertext Transfer Protocol (HTTP) and other types of botnets because P2P traffic has typical features of the centralization and distribution. To resolve the issues of P2P botnet identification, we propose an effective multi-layer traffic classification method by applying machine learning classifiers on features of network traffic. Our work presents a framework based on decision trees which effectively detects P2P botnets. A decision tree algorithm is applied for feature selection to extract the most relevant features and ignore the irrelevant features. At the first layer, we filter non-P2P packets to reduce the amount of network traffic through well-known ports, Domain Name System (DNS). query, and flow counting. The second layer further characterized the captured network traffic into non-P2P and P2P. At the third layer of our model, we reduced the features which may marginally affect the classification. At the final layer, we successfully detected P2P botnets using decision tree Classifier by extracting network communication features. Furthermore, our experimental evaluations show the significance of the proposed method in P2P botnets detection and demonstrate an average accuracy of 98.7%.

Measuring Peer-to-Peer Botnets Using Control Flow Stability

The Aggregation and Stability Analysis of Network Traffic for Structured-P2P-based Botnet Detection.

Two Stage P2P Botnet Detection Method Based on Flow Similarity

New Detection of Peer-to-Peer Controlled Bots on the Host

Recognition of P2P Bots Control Behavior

Enhanced PeerHunter: Detecting Peer-to-peer Botnets through Network-Flow Level Community Behavior Analysis

Detection of Peer-to-Peer Botnets

A Hybrid Technique to Detect Botnets, Based on P2P Traffic Similarity.

Actively Measuring Bots in Peer-to-Peer Networks

The New Architecture of P2P-Botnet

Structural Robustness in Peer to Peer Botnets

Using Unsupervised Machine Learning to Detect Peer-to-Peer Botnet Flows

Efficient Detect Scheme of Botnet Command and Control Communication.

Poster: Combine Topology and Traffic to Calibrate P2P Botnet Identification in Large-Scale Network.

Characterizing the IRC-based Botnet Phenomenon

Distributed Threat Intelligence Sharing System: A New Sight of P2P Botnet Detection

An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers

An Anomaly-based Botnet Detection Approach for Identifying Stealthy Botnets

Reconstruction of C&C Channel for P2P Botnet

P2P Botnet Control Strategy Based on Social Network Analysis

An Effective Conversation-Based Botnet Detection Method