본문 바로가기
KERD
논문KCI 등재

P2P 봇넷 탐지 연구의 비교 및 분석

Comparison and Analysis of P2P Botnet Detection Schemes

조경산|Wujian Ye
한국컴퓨터정보학회 (The Korean Society Of Computer And Information)|2017.03|한국컴퓨터정보학회논문지 (Journal of The Korea Society of Computer and Information)|제22권 제3호|pp. 69-79|DOI https://doi.org/10.9708/jksci.2017.22.03.069

0

조회

0

다운로드

1

인용

0

참고문헌

키워드

machine learninglife cycleP2P botnet detectiondata sets
주제분류컴퓨터학

초록

In this paper, we propose our four-phase life cycle of P2P botnet with corresponding detection methods and the future direction for more effective P2P botnet detection. Our proposals are based on the intensive analysis that compares existing P2P botnet detection schemes in different points of view such as life cycle of P2P botnet, machine learning methods for data mining based detection, composition of data sets, and performance matrix. Our proposed life cycle model composed of linear sequence stages suggests to utilize features in the vulnerable phase rather than the entire life cycle. In addition, we suggest the hybrid detection scheme with data mining based method and our proposed life cycle, and present the improved composition of experimental data sets through analysing the limitations of previous works.

Abstract

In this paper, we propose our four-phase life cycle of P2P botnet with corresponding detection methods and the future direction for more effective P2P botnet detection. Our proposals are based on the intensive analysis that compares existing P2P botnet detection schemes in different points of view such as life cycle of P2P botnet, machine learning methods for data mining based detection, composition of data sets, and performance matrix. Our proposed life cycle model composed of linear sequence stages suggests to utilize features in the vulnerable phase rather than the entire life cycle. In addition, we suggest the hybrid detection scheme with data mining based method and our proposed life cycle, and present the improved composition of experimental data sets through analysing the limitations of previous works.

참고문헌 (43)

  1. W. Ye, "Hybrid P2P Traffic Classification with heuristic rules and machine Learning", Soft Computing, 19(9), pp.1815~1827 (2014)
  2. M. Feeil, "A survey of Botnet and Botnet Detection", Procs. of the Third International Conference on Emerging Security Information, systems and Technologies, pp.268~273 (2009)
  3. W. Ye, "P2P and P2P Botnet Traffic Classification in Two Stages", Soft Computing, 21(5), pp.1315~1326 (2017)
  4. N. Kheir, "Behavioral fine-grained detection and classification of P2P bots", Journal of Computer Virology and Hacking Techniques, 11(4), pp.217~233 (2015)
  5. M. Mahmoud, "A Survey on Botnet Architectures, Detection and Defences", International Journal of Network Security, 17(3), pp.272~289 (2015)
  6. S. Silva, "Botnets: A survey", Computer Networks, the International Journal of Computer & Telecommunications Networking, 57(2), pp.378~403 (2013)
  7. M. Soysal, "Machine learning algorithms for accurate flow-based network traffic classification: Evaluation and comparison", Performance Evaluation, 67(6), pp.451~467 (2010)
  8. I. Ghafi, "A Survey on Botnet Command and Control Traffic Detection", International Journal of Advances in Computer Networks and Its Security, 5(2), pp.75~80 (2015)
  9. A. Obeidat, "Survey of the P2P botnet detection methods", International Journal of Emerging Trends of Technology in Computer Science, 5(2), pp.12~23 (2016)
  10. S. Ghalebandi, "A Survey on P2P Botnets Detection", Procs. of International Conference on Communication and Broadband Networking (ICCBN 2011) (2011)
  11. M. Elhalabi, "A Review of Peer-to-Peer Botnet Detection Techniques", Journal of Computer Science, 10(1), pp.169~177 (2013)
  12. P. Vadivu, "A Survey on Botnet Dectection Approaches In Peer-To-Peer Network", International Journal of Advances in Computer Science and Technology, 3(5), pp.311~317 (2014)
  13. P. Wang, "Handbook of Information and Communication Security", pp.335~350 (2009)
  14. Priyanka, "A review of recent Peer-to-Peer botnet detection techniques", Procs. of International Conference on Electronics and Communication Systems. IEEE, pp.1312~1317 (2015)
  15. R. Rodriguez-Gomes, "Analysis of Botnets through Life-Cycle", Procs. of SECRYPT 2011 International Conference on Security and Cryptography, pp.257~262 (2011)
  16. N. Hachenm, "Botnets: Lifecycle and Taxonomy", Procs. of 2011 Conference on Network and Information Systems Security (SAR-SSI), pp.1~8 (2011)
  17. J.B. Grizzard, "Peer-to-peer botnets: overview and case study", Procs. of USENIX Workshop on Hot Topics in Understanding Botnets (HotBots’07), pp.1~8 (2007)
  18. J. Leonard, "A Framework for understanding botnets", Procs. of the international conference on availability, reliability and security, pp.917~922 (2009)
  19. W. Tarng, "A P2P Botnet Virus Detection System Based on Data-Mining Algorithms", International Journal of Computer Science & Information Technology, 4(5), pp.51~65 (2012)
  20. H. Li, "Modeling to Understand P2P Botnets", Procs. of International Conference on Instrumentation and Measurement, Computer, Communication and Control, pp.75~78 (2012)
  21. M. Alauthaman, "A P2P Botnet detection scheme based on decision tree and adaptive multilayer neural networks", Neural Computer and Applications(First Online) (2016)
  22. H. Hang, "Entelecheia: Detecting p2p botnets in their waiting stage", Procs. of IFIP Networking Conference, pp.1~9 (2013)
  23. P. Narang, "Peershark: Detecting Peer-to-Peer Botnets by Tracking Conversions", IEEE Security and Privacy workshop, pp.108~115 (2014)
  24. Y Li, "A P2P-Bonet Detection Model and Algorithms Based on Network Streams Analysis", International Conference on Future Information Technology and Management Engineering, 1, pp.55~58 (2010)
  25. Y. Fan, "A P2P Botnet Detection Method Used On-line Monitoring and Off-line Detection", Int. Journal of Security and Its Applications, 8(3), pp.87~96 (2014)
  26. C. Sheng, "The P2P Botnet Online Detect Approach Research", Acta Electronica Sinica, 39(4), pp.906~912 (2011)
  27. P. Barthakur, "An Efficient Machine Learning Based Classification Scheme for Detecting Distributed Command & Control Traffic of P2P Botnets", International Journal of Modern Education and Computer Science, 5(10), pp.9~18 (2013)
  28. P. Bharathula, "Equitable Machine Learning Algorithms to Probe Over P2P Botnets", Procs. of the 4th International Conference on Frontiers in Intelligent Computing: Theory and Applications(FICTA), pp.13~21 (2015)
  29. L H Liao, "Peer to Peer Botnet Detection Using Data Mining Scheme", Procs. of International Conference on Internet Technology and Applications. IEEE, pp.1~4 (2010)
  30. S. Garg, "Behaviour analysis of machine learning algorithms for detecting P2P botnets", Procs. of IEEE 15th International Conference on Advanced Computing Technologies (ICACT):, pp.1~4 (2013)
  31. D. Zhao, "Peer to Peer Botnet Detection Based on Flow Intervals", Information Security and Privacy Research-27th IFIP TC 11 Information Security and Privacy Conference, pp.87~102 (2012)
  32. P. Wang, "A Systematic Study on Peer-to-Peer Botnets", International Conference on Computer Communications and Networks, IEEE ICCCN 2009, pp.1~8 (2009)
  33. H. Jiang, "Detecting P2P botnets by discovering flow dependency in C&C traffic", Peer-to-Peer Networking and Applications, pp.320~331 (2014)
  34. 예우지엔, "개선된 휴리스틱 규칙 및 의사 결정 트리 분석을 이용한 P2P 트래픽 분류 기법", 한국컴퓨터정보학회논문지, 19(3), pp.45~54 (2014), 한국컴퓨터정보학회
  35. G. Gu, "BotMiner:clustering analysis of network traffic for protocol and structure independent botnet detection", SS’08 Procs of the 17th conference on Security Symposium, pp.139~154 (2008)
  36. M. Yahyazadeh, "BotOnus: An online unsupervised method for botnet detection", The ISC Int'l Journal of Information Security, 4(1), pp.51~62 (2012)
  37. J. Kang, "Application Entropy Theory to Detect New Peer-to-Peer Botnet with Multi-chart CUSUM", Procs. of 2009 Second International Symposium on Electronic Commerce and Security, pp.471~475 (2009)
  38. B. Wang, "Measuring Peer-to-Peer botnets using control flow stability", Procs. of IEEE International Conference on Availability, Reliability and Security ARES'09, pp.663~669 (2009)
  39. S. K. Noh, "Detecting P2P Botnets Using a Multi-phased Flow Model", Procs. of Third International Conference on Digital Society. IEEE Computer Society, pp.247~253 (2009)
  40. On detection of storm botnets. Real-Time Computing Laboratory, "Y. Zeng", The University of Michigan, 1~7, pp.Technical report CSE-TR-560-09 (2009)
  41. B. Rahbarinia, "PeerRush: Mining for unwanted p2p traffic", DIMVA 2013-Detection of Intrusions and Malware, and Vulnerability Assessment. Lecture Notes in Computer Science, 7967, pp.62~82 (2013)
  42. S. Garg, "Scalable P2P bot detection system based on network data stream", Peer-to-Peer Networking and Applications, 9(6), pp.1162~1176 (2016)
  43. 홍의석, "클래스 불균형 데이터를 사용한 심각도 기반 소프트웨어 품질 예측", 한국컴퓨터정보학회논문지, 21(4), pp.73~80 (2016), 한국컴퓨터정보학회

관련 논문AI추천

Scalable P2P Botnet Detection with Threshold Setting in Hadoop Framework김광조, Khalid Huseynov, Paul D. Yoo한국정보보호학회 · 정보보호학회논문지2015 · 제25권 제4호Exploring Infected-host Enumeration Methods for Advanced Peer-to-Peer BotnetsByungHoon Kang, Chris Nunnery에스케이텔레콤 (주) · Telecommunications Review2012 · 제22권 제6호협업 기반의 중앙집중형 봇넷 탐지 및 관제 시스템 설계권종훈, 오주형, 이희조, 임채태, 정현철, 지승구, 최현상한국정보보호학회 · 정보보호학회논문지2009 · 제19권 제3호다크넷 트래픽 기반의 알려지지 않은 IoT 봇넷 선제탐지 방안노희준, 박건량, 송중석한국정보보호학회 · 정보보호학회논문지2023 · 제33권 제2호엔트로피를 이용한 분산 서비스 거부 공격 탐지에 효과적인 특징 생성 방법 연구김태훈, 문종섭, 서기택, 이영훈, 임종인한국정보보호학회 · 정보보호학회논문지2010 · 제20권 제4호IoT 네트워크에서 악성 트래픽을 탐지하기 위한 머신러닝 알고리즘의 성능 비교연구현미진한국디지털정책학회 · 디지털융복합연구2021 · 제19권 제9호

이 간행물의 다른 논문 (18건)

낸드 플래시 메모리 시스템을 위한 시간 인지 하이브리드 마모도 평준화 기법곽종욱, 황상호pp. 1-8세트별 재사용 정보 기반 쓰래싱 저항 캐쉬 관리 기법심규연, 김철홍pp. 9-16Juliet과 STONESOUP 테스트 모음을 사용한 C/C++ 프로그램의 보안약점 탐지를 위한 정적 분석기 평가김태환, 박영관, 표창우, 한경숙, 서현지pp. 17-25편향 판별 분석을 이용한 차선 검출최상일, 곽노준, 김태경pp. 27-34IoT 환경에 자원 협업 시스템을 위한 MBTI 기반 추천박종현pp. 35-43
원문 보기