Boosting the Scalability of Botnet Detection Using Adaptive Traffic Sampling

Boosting the Scalability of Botnet Detection Using Adaptive Traffic Sampling

Cached

Download Links

by Junjie Zhang , Xiapu Luo , Roberto Perdisci , Guofei Gu , Wenke Lee , Nick Feamster

Citations:

1 - 0 self

Versions

Version 0

Version History

Metadata Version 0

Datum	Value	Source
TITLE	Boosting the Scalability of Botnet Detection Using Adaptive Traffic Sampling	SVM HeaderParse 0.2
AUTHOR NAME	Junjie Zhang	SVM HeaderParse 0.2
AUTHOR AFFIL	Georgia Institute of Technology,; University of Georgia; Hong Kong Polytechnic University,	SVM HeaderParse 0.2
AUTHOR ADDR	Texas A&M University	SVM HeaderParse 0.2
AUTHOR NAME	Xiapu Luo	SVM HeaderParse 0.2
AUTHOR AFFIL	Georgia Institute of Technology,; University of Georgia; Hong Kong Polytechnic University,	SVM HeaderParse 0.2
AUTHOR ADDR	Texas A&M University	SVM HeaderParse 0.2
AUTHOR NAME	Roberto Perdisci	SVM HeaderParse 0.2
AUTHOR AFFIL	Georgia Institute of Technology,; University of Georgia; Hong Kong Polytechnic University,	SVM HeaderParse 0.2
AUTHOR ADDR	Texas A&M University	SVM HeaderParse 0.2
AUTHOR NAME	Guofei Gu	SVM HeaderParse 0.2
AUTHOR AFFIL	Georgia Institute of Technology,; University of Georgia; Hong Kong Polytechnic University,	SVM HeaderParse 0.2
AUTHOR ADDR	Texas A&M University	SVM HeaderParse 0.2
AUTHOR NAME	Wenke Lee	SVM HeaderParse 0.2
AUTHOR AFFIL	Georgia Institute of Technology,; University of Georgia; Hong Kong Polytechnic University,	SVM HeaderParse 0.2
AUTHOR ADDR	Texas A&M University	SVM HeaderParse 0.2
AUTHOR NAME	Nick Feamster	SVM HeaderParse 0.2
AUTHOR AFFIL	Georgia Institute of Technology,; University of Georgia; Hong Kong Polytechnic University,	SVM HeaderParse 0.2
AUTHOR ADDR	Texas A&M University	SVM HeaderParse 0.2
ABSTRACT	Botnets pose a serious threat to the health of the Internet. Most current network-based botnet detection systems require deep packet inspection (DPI) to detect bots. Because DPI is a computational costly process, such detection systems cannot handle large volumes of traffic typical of large enterprise and ISP networks. In this paper we propose a system that aims to efficiently and effectively identify a small number of suspicious hosts that are likely bots. Their traffic can then be forwarded to DPI-based botnet detection systems for fine-grained inspection and accurate botnet detection. By using a novel adaptive packet sampling algorithm and a scalable spatial-temporal flow correlation approach, our system is able to substantially reduce the volume of network traffic that goes through DPI, thereby boosting the scalability of existing botnet detection systems. We implemented a proof-of-concept version of our system, and evaluated it using real-world legitimate and botnet-related network traces. Our experimental results are very promising and suggest that our approach can enable the deployment of botnet-detection systems in large, high-speed networks.	SVM HeaderParse 0.2
CITATIONS	24 found	ParsCit 1.0