본문 바로가기
KERD
논문KCI 등재

Scalable P2P Botnet Detection with Threshold Setting in Hadoop Framework

김광조|Khalid Huseynov|Paul D. Yoo
한국정보보호학회 (Korea Institute Of Information Security And Cryptology)|2015.08|정보보호학회논문지 (Journal of The Korea Institute of Information Security and Cryptology)|제25권 제4호|pp. 807-816|DOI http://dx.doi.org/10.13089/JKIISC.2015.25.4.807

0

조회

0

다운로드

0

인용

0

참고문헌

키워드

scalabilityHadoopbotnetsunsupervised detection.
주제분류컴퓨터학

초록

During the last decade most of coordinated security breaches are performed by the means of botnets, which is a large overlay network of compromised computers being controlled by remote botmaster. Due to high volumes of traffic to be analyzed, the challenge is posed by managing tradeoff between system scalability and accuracy. We propose a novel Hadoop-based P2P botnet detection method solving the problem of scalability and having high accuracy. Moreover, our approach is characterized not to require labeled data and applicable to encrypted traffic as well.

Abstract

During the last decade most of coordinated security breaches are performed by the means of botnets, which is a large overlay network of compromised computers being controlled by remote botmaster. Due to high volumes of traffic to be analyzed, the challenge is posed by managing tradeoff between system scalability and accuracy. We propose a novel Hadoop-based P2P botnet detection method solving the problem of scalability and having high accuracy. Moreover, our approach is characterized not to require labeled data and applicable to encrypted traffic as well.

참고문헌 (34)

  1. P. Maymounkov, "Peer-to-Peer Systems", pp.53~65 (2002), Springer Berlin Heidelberg
  2. M. Ripeanu, "Peer-to-peer architectu- re case study: Gnutella network", Peer-to-Peer Computing Proceedings. First International Conference on, pp.99~100 (2001)
  4. C. Miller, "The Rustock Botnet Spams Again" (2008)
  5. B. Stone-Gross, "Analysis of a botnet takeover", Security and Privacy, IEEE, 9(1), pp.64~72 (2011)
  6. D.I. Jang, "Analysis of HTTP2P botnet: case study waledac", Communications (MICC), IEEE 9th Malaysia International Conference on, pp.409~412 (2009)
  7. S. Stover, "Analysis of the Storm and Nugache Trojans : P2P is here", USENIX;login, 32(6), pp.18~27 (2007)
  8. B. Stone-Gross, "Your botnet is my botnet:analysis of a botnet takeover", Proceedings of the 16th ACM conference on Computer and communications security, pp.635~647 (2009)
  9. C. Rossow, "Sok : P2pwned-modeling and evaluating the resilience of peer-to-peer botnets", Security and Privacy(SP), IEEE Symposium on, pp.97~111 (2013)
  10. J. Goebel, "Rishi : Identify bot contaminated hosts by irc nickname evaluation", Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, pp.8~8 (2007)
  11. M. Roesch, "Snort : Lightweight Intrusion Detection for Networks", LISA, 99(1), pp.229~238 (1999)
  12. Y. Xie, "Spamming botnets : signatures and characteristics", ACM SIGCOMM Computer Communication Review, 38(4), pp.171~182 (2008)
  13. E. Stinson, "Towards Systematic Evaluation of the Evadability of Bot", Botnet Detection Methods, 2008, pp.8, 1~9
  14. G. Gu, "BotHunter : Detecting Malware Infection Through IDS-Driven Dialog Correlation", Usenix Security, 7, pp.1~16 (2007)
  15. G. Gu, "BotMiner : Clustering Analysis of Network Traffic for Protocol-and Structure-Independent Botnet Detection", USENIX SecuritySymposium, 5(2), pp.139~154 (2008)
  16. B. Rahbarinia, "Peerrush : Mining for unwanted p2p traffic", Journal of Information Security and Applications, 19(3), pp.194~208 (2014)
  17. J. Zhang, "Building a scalable system for stealthy p2p-botnet detection", Information Forensics and Security, IEEE Transactions on, 9(1), pp.27~38 (2014)
  18. S. Saad, "Detecting P2P botnets through network behavior analysis and machine learning", Privacy, Security and Trust (PST), Ninth Annual International Conference on, pp.174~180 (2011)
  19. J. Dean, "MapReduce : simplified data processing on large clusters", Communications of the ACM, 51(1), pp.107~113 (2008)
  20. V. Paxson, "Bro : a system for detecting network intruders in real-time", Computer networks, 31(23), pp.2435~2463 (1999)
  21. M. A. Jamshed, "Kargus:a highly-scalable software-based intrusion detection system", Proceedings of the 2012 ACM conference on Computer and communications security, pp.317~328 (2012)
  22. B. Wang, "Measuring peer-to-peer botnets using control flow stability", Availability, Reliability and Security, ARES'09, International Conference on, pp.663~669 (2009)
  23. D. Zhao, "Peer to peer botnet detection based on flow intervals", Information Security and Privacy Research, pp.87~102 (2012)
  24. Y. Zhao, "BotGraph : Large Scale Spamming Botnet Detection", NSDI, 9, pp.321~334 (2009)
  25. J. Francois, "Botcloud: Detecting botnets using mapreduce", Information Forensics and Security (WIFS), IEEE International Workshop on, pp.1~6 (2011)
  26. K. Singh, "Big data analytics framework for peer-to-peer botnet detection using random forests", Information Sciences, 278, pp.488~497 (2014)
  27. K. Shvachko, "The hadoop distributed file system", Mass Storage Systems and Technologies (MSST), IEEE 26th Symposium on, pp.1~10 (2010)
  28. Y. Lee, "Toward scalable internet traffic measurement and analysis with hadoop", ACM SIGCOMM Computer Communication Review, 43(1), pp.5~13 (2013)
  29. D. Stutzbach, "Understanding churn in peer-to-peer networks", Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, pp.189~202 (2006)
  30. H.S. Wu, "Identifying the use of data", voice, Communications, ICC'09. IEEE International Conference on, pp.2009[DOI]
  31. D. Zhao, "Botnet detection based on traffic behavior analysis and flow intervals", Computers and Security, 39, pp.2~16 (2013)
  33. G. Szabó, "On the validation of traffic classification algorithms", Passive and Active Network Measurement, pp.72~81 (2008)

관련 논문AI추천

Exploring Infected-host Enumeration Methods for Advanced Peer-to-Peer BotnetsByungHoon Kang, Chris Nunnery에스케이텔레콤 (주) · Telecommunications Review2012 · 제22권 제6호P2P 봇넷 탐지 연구의 비교 및 분석조경산, Wujian Ye한국컴퓨터정보학회 · 한국컴퓨터정보학회논문지2017 · 제22권 제3호High Rate Denial-of-Service Attack Detection System for Cloud Environment Using Flume and Spark이길흥, Janitza Punto Gutierrez한국정보처리학회 · JIPS(Journal of Information Processing Systems)2021 · 제17권 제4호A Security Protection Framework for Cloud Computing이창훈, Wenzheng Zhu한국정보처리학회 · JIPS(Journal of Information Processing Systems)2016 · 제12권 제3호Distributed and Scalable Intrusion Detection System Based on Agents and Intelligent TechniquesAly M. El-Semary, Mostafa Gadal-Haqq M. Mostafa한국정보처리학회 · JIPS(Journal of Information Processing Systems)2010 · 제6권 제4호Study on Existing Attacks to Reveal BitTorrent User's IP Address in Tor Network다할 사우라브, 신석주, 이성렬한국차세대컴퓨팅학회 · 한국차세대컴퓨팅학회 논문지2015 · 제11권 제5호

이 간행물의 다른 논문 (23건)

GPU의 스레드와 공유메모리를 이용한 LEA 최적화 방안윤지원, 박무규pp. 719-726수평적 상관관계 분석에 안전한 블라인딩 대응기법에 대한 전력 분석 공격홍석희, 김희석, 이상엽, 김태원pp. 727-738마스킹 기법이 적용된 SEED 알고리즘에 대한 취약점 분석김태원, 장남수pp. 739-747ARM-11 프로세서 상에서의 SHA-3 암호 알고리즘 구현 기술강명모, 서창호, 이희웅, 홍도원pp. 749-757무선 센서 네트워크에서 그리드 정보를 활용한 위치기반 키 관리 연구최재우, 김주엽, 권태경, 김용현pp. 759-766
원문 보기