NDLI: Detecting P2P bots by mining the regional periodicity

Content Provider	Springer Nature Link
Author	Qiao, Yong Yang, Yue xiang He, Jie Tang, Chuan Zeng, Ying zhi
Copyright Year	2013
Abstract	Peer-to-peer (P2P) botnets outperform the traditional Internet relay chat (IRC) botnets in evading detection and they have become a prevailing type of threat to the Internet nowadays. Current methods for detecting P2P botnets, such as similarity analysis of network behavior and machine-learning based classification, cannot handle the challenges brought about by different network scenarios and botnet variants. We noticed that one important but neglected characteristic of P2P bots is that they periodically send requests to update their peer lists or receive commands from botmasters in the command-and-control (C&C) phase. In this paper, we propose a novel detection model named detection by mining regional periodicity (DMRP), including capturing the event time series, mining the hidden periodicity of host behaviors, and evaluating the mined periodic patterns to identify P2P bot traffic. As our detection model is built based on the basic properties of P2P protocols, it is difficult for P2P bots to avoid being detected as long as P2P protocols are employed in their C&C. For hidden periodicity mining, we introduce the so-called regional periodic pattern mining in a time series and present our algorithms to solve the mining problem. The experimental evaluation on public datasets demonstrates that the algorithms are promising for efficient P2P bot detection in the C&C phase.
Starting Page	682
Ending Page	700
Page Count	19
File Format	PDF
ISSN	18691951
Journal	Journal of Zhejiang University SCIENCE C
Volume Number	14
Issue Number	9
e-ISSN	1869196X
Language	English
Publisher	Springer Berlin Heidelberg
Publisher Date	2013-09-06
Publisher Place	Berlin, Heidelberg
Access Restriction	Subscribed
Subject Keyword	P2P botnet detection Regional periodicity Apriori Autocorrelation function Evaluation function Computer Science Electrical Engineering Computer Hardware Computer Systems Organization and Communication Networks Electronics and Microelectronics, Instrumentation Communications Engineering, Networks
Content Type	Text
Resource Type	Article
Subject	Engineering

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Botnet detection techniques: review, future trends, and issues

A new data normalization method for unsupervised anomaly intrusion detection

Semantics ⊓ scalability ⊨ ⊥?

Fine-grained P2P traffic classification by simply counting flows

AGCD: a robust periodicity analysis method based on approximate greatest common divisor

Semantics and the crowd

Overlapping community detection combining content and link

Dust collector localization in trouble of moving freight car detection system

An incentive model for voting based on information-hiding in P2P networks

Detecting P2P bots by mining the regional periodicity

Similar Documents

Botnet detection techniques: review, future trends, and issues

A new data normalization method for unsupervised anomaly intrusion detection

Semantics ⊓ scalability ⊨ ⊥?

Fine-grained P2P traffic classification by simply counting flows

AGCD: a robust periodicity analysis method based on approximate greatest common divisor

Semantics and the crowd

Overlapping community detection combining content and link

Dust collector localization in trouble of moving freight car detection system

An incentive model for voting based on information-hiding in P2P networks

Detecting P2P bots by mining the regional periodicity