Loading...
Please wait, while we are loading the content...
Similar Documents
Botnet Detection by Abnormal IRC Traffic Analysis
| Content Provider | Semantic Scholar |
|---|---|
| Author | Lai, Gu-Hsin Chen, Chia-Mei Tzeng, Ray-Yu Laih, Chi-Sung Faloutsos, Christos |
| Copyright Year | 2009 |
| Abstract | Recently, Botnet has become one of the most severe threats on the Internet because it is hard to be prevented and cause huge losses. Prior intrusion detection system researches focused on traditional threats like virus, worm or Torjan. However, traditional intrusion detection system cannot detect Botnet activities before botmasters launch final attack. In Botnet attack, in order to control a large amount of compromised hosts (bots), Botmasters use public internet service as communication and control channel (C&C Channel). IRC (Internet Relay Chat) is the most popular communication service which botbasters use to send command to their bots. Once bots receive commands from botmasters, they will do the corresponding abnormal action. It seems that Botnet activities could be detected by observing abnormal IRC traffic. In this paper, we will focus on abnormal IRC traffic analysis, we will use three unique characteristics of Botnet ,“Group Activity”, “Homogeneous Response” and “Abnormal direction of PING and PONG messages” to detect abnormal Botnet activities in LAN. We develop an on-line IRC IDS to detect abnormal IRC behavior. In the proposed system, abnormal IRC traffic can be detect and we can (1) identify the infected hosts (bots) before botmasters launch final attack (e.g. DDoS or Phishing) and (2) find out the malicious IRC servers in LAN in real time. The experiments shows that the proposed system can indeed detect abnormal IRC traffic and prevent Botnet attack. |
| File Format | PDF HTM / HTML |
| Alternate Webpage(s) | http://jwis2009.nsysu.edu.tw/location/paper/Botnet%20Detection%20by%20Abnormal%20IRC%20Traffic%20Analysis.pdf |
| Language | English |
| Access Restriction | Open |
| Content Type | Text |
| Resource Type | Article |
