• Jul 03, 2017 News!JACN Vol.4, No.2 has been indexed by EI (inspec)!   [Click]
  • Jul 12, 2017 News!JACN Vol.5, No.1 has been published with online version.
  • Jul 03, 2017 News!Welcome to join in the 2017 8th International Conference on Networking and Information Technology (ICNIT 2017), which will be held in Penang, Malaysia during November 24-26, 2017.
General Information
    • ISSN: 1793-8244
    • Frequency: Semiyearly
    • DOI: 10.18178/JACN
    • Editor-in-Chief: Dr. Ka Wai Gary Wong
    • Executive Editor: Ms. Nina Lee
    • Abstracting/ Indexing: EI (INSPEC, IET), Engineering & Technology Digital Library, DOAJ, Electronic Journals Library, Ulrich's Periodicals Directory, International Computer Science Digital Library (ICSDL), ProQuest, and Google Scholar.
    • E-mail: jacn@ejournal.net
Editor-in-chief
Dr. Ka Wai Gary Wong
Division of Information and Technology Studies, Faculty of Education, The University of Hong Kong.
It's a honor to serve as the editor-in-chief of JACN. I'll work together with the editors and reviewers to help the journal progress
JACN 2015 Vol.3(1): 49-55 ISSN: 1793-8244
DOI: 10.7763/JACN.2015.V3.141

CluSiBotHealer: Botnet Detection through Similarity Analysis of Clusters

Pijush Barthakur, Manoj Dahal, and Mrinal Kanti Ghose
Abstract—Botnets are responsible for most of the security threats in the Internet. Botnet attacks often leverage on their coordinated structures among bots spread over a vast geographical area. In this paper, we propose CluSiBotHealer, a novel framework for detection of Peer-to-Peer (P2P) botnets through data mining technique. P2P botnets are more resilient structure of botnets (re)designed to overcome single point of failure of centralized botnets. Our proposed system is based on clustering of C&C flows within a monitored network for suspected bots. Leveraging on similarity of packet structures and flow structures of frequently exchanged C&C flows within a P2P botnet, our proposed system initially uses clustering of flows and then Jaccard similarity coefficient on sample sets derived from clusters for accurate detection of bots. Ours is a very effective and novel framework which can be used for proactive detection of P2P bots within a monitored network. We empirically validated our model on traces collected from three different P2P botnets namely Nugache, Waledac and P2P Zeus.

Index Terms—Bot, botnet, clustering, peer-to-peer.

Pijush Barthakur is with the Department of Computer Applications, Sikkim Manipal Institute of Technology, Sikkim, India (e-mail: pijush.barthakur@gmail.com).
Manoj Dahal is with the Novell IDC, Bagmane Tech Park, C V Ramannagar, Bangalore, India (e-mail: mdahal@novell.com).
Mrinal Kanti Ghose is with the Department of Computer Science and Engineering, Sikkim Manipal Institute of Technology, Sikkim, India (e-mail: mkghose2000@yahoo.com).

[PDF]

Cite:Pijush Barthakur, Manoj Dahal, and Mrinal Kanti Ghose, "CluSiBotHealer: Botnet Detection through Similarity Analysis of Clusters," Journal of Advances in Computer Networks vol. 3, no. 1, pp. 49-55, 2015.

Copyright © 2008-2017. Journal of Advances in Computer Networks.  All rights reserved.
E-mail: jacn@ejournal.net