NDLI: Discovering and analyzing deviant communities: Methods and experiments

Content Provider	IEEE Xplore Digital Library
Author	Paxton, N.C. Dae-il Jang Moskowitz, I.S. Ahn, G.-J. Russell, S.
Copyright Year	2014
Description	Author affiliation: Inf. Technol. Div., Naval Res. Lab., Washington, DC, USA (Paxton, N.C.; Moskowitz, I.S.; Russell, S.) \|\| Sch. of Comput., Inf., Decision Syst. Eng., Arizona State Univ., Tempe, AZ, USA (Dae-il Jang; Ahn, G.-J.)
Abstract	Botnets continue to threaten the security landscape of computer networks worldwide. This is due in part to the time lag present between discovery of botnet traffic and identification of actionable intelligence derived from the traffic analysis. In this article we present a novel method to fill such a gap by segmenting botnet traffic into communities and identifying the category of each community member. This information can be used to identify attack members (bot nodes), command and control members (Command and Control nodes), botnet controller members (botmaster nodes), and victim members (victim nodes). All of which can be used immediately in forensics or in defense of future attacks. The true novelty of our approach is the segmentation of the malicious network data into relational communities and not just spatially based clusters. The relational nature of the communities allows us to discover the community roles without a deep analysis of the entire network. We discuss the feasibility and practicality of our method through experiments with real-world botnet traffic. Our experimental results show a high detection rate with a low false positive rate, which gives encouragement that our approach can be a valuable addition to a defense in depth strategy.
Starting Page	163
Ending Page	170
File Size	388714
Page Count	8
File Format	PDF
ISBN	9781631900433
DOI	10.4108/icst.collaboratecom.2014.257262
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-10-22
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	ICST
Subject Keyword	Command and control systems Protocols Communities Manuals Internet IP networks Payloads
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Discovering and Analyzing Deviant Communities: Methods and Experiments

Employing IP-Based Technologies for Pervasive Connectivity and Interoperability

Comparative Analysis and Evaluation of Botnet Command and Control Models

Tutorial: Multipath support in IP networks

A distributed architecture for Internet router level topology discovering systems

An approach to flexible QoS routing with active networks

Quick Finding of Network Video Stream

DNS for Massive-Scale Command and Control

Internet Protocol security and Power Line Communication

Discovering and analyzing deviant communities: Methods and experiments

Similar Documents

Discovering and Analyzing Deviant Communities: Methods and Experiments

Employing IP-Based Technologies for Pervasive Connectivity and Interoperability

Comparative Analysis and Evaluation of Botnet Command and Control Models

Tutorial: Multipath support in IP networks

A distributed architecture for Internet router level topology discovering systems

An approach to flexible QoS routing with active networks

Quick Finding of Network Video Stream

DNS for Massive-Scale Command and Control

Internet Protocol security and Power Line Communication

Discovering and analyzing deviant communities: Methods and experiments