臺灣博碩士論文加值系統

以決策樹偵測殭屍網路之研究

Botnet is the most dangerous and widespread threat among the diverse forms of malware internet-attacks nowaday. A botnet is a group of damaged computers connected via Internet which are remotely accessed and controlled by hackers to make various network attacks. Malicious activities include DDoS attack, spam, click fraud, identity theft and information phishing. The most basic characteristic of botnets is the use of command and control channels to communicate with botnet and through which bonet can be updated and command. Botnet has become a common and effective tool used by Botmaster in many cyber-attacks. Recently malicious botnets develop to HTTP botnets instead of typical IRC botnets. HTTP botnets is the latest generations of Botnet ,and it use the standard HTTP protocol to contact with their bots. By using the normal HTTP traffic, the bots is consider as normal users of the networks, and the current network security systems cannot detect out them. To solve this problem, a method based on network behavior analysis system was evolved to improve modify and adding new features to the current methods of detecting HTTP-based Botnets and their bots.

ABSTRACT iii
ACKNOWLEDGMENT iv
LIST OF FIGURES viii
LIST OF TABLES ix
CHAPTER ONE INTRODUCTION 1
1.1 Botnets: Current Largest Security Threat 1
1.2 Statement of Problem 2
1.3 Statement of Objectives 3
1.4 Thesis Scope 3
1.5 Thesis Organization 3
CHAPTER TWO RELATED WORK 5
2.1 Overview 5
2.2 Botnet Centralized Command and Control (C&C) Mechanism 5
2.3 IRC-based Botnets 7
2.4 HTTP-based Botnets 9
2.5 Existing Botnet Detection Methods 11
2.5.1 Honeypot and Honeynet 11
2.5.2 Detection by Signature 12
2.5.3 Detection by DNS Monitoring 12
2.5.4 Detection using Attack Behavior Analysis 14
2.6 Detection Based on Network Behavior Analysis 15
2.6.1 Why Choose Network Behaviour Analysis? 15
2.6.2 Existing Detection Methods Based on NBA 15
2.7 Evaluation of Existing NBA Methods for Botnet Detection 17
2.8 Conclusion 19
CHAPTER THREE PROPOSAL METHOD 20
3.1 Introduction 20
3.2 Proposed flow chart 20
3.3 Data collection: 21
3.3.1 HTTP traffic filter 22
3.3.2 GET and POST method filter 22
3.4 Feature extraction 23
3.5 Feature Selection 23
3.6 Decision tree algorithms 26
3.6.1 Information Gain 26
3.6.2 Gain ratio 27
CHAPTER FOUR EXPERIMENTAL RESULT 29
4.1 Introduction 29
4.1 The Dataset 29
4.2 Preprocessing 32
4.3 Transformation 32
4.3.1 Attribute Reduction 32
4.3.2 Discretization 34
4.4 Data mining 34
CHAPTER FIVE CONCLUSION AND FUTURE WORK 45
5.1 Introduction 45
5.2 Achievement of Objectives 45
5.3 Limitations and Future Work 46
5.3.1 Real Time Detection: 46
5.3.2 Small data 46
5.3.3 Other Type of Bots and Botnets: 46
5.3.4 Prevention Methods: 46
5.3.5 Advanced the HTTP field header for Botnet detection: 47
5.4 Conclusion 47
REFERENCES 48

Burji, S., Liszka, K. J., & Chan, C. C. (2010). Malware analysis using reverse engineering and data mining tools. In System Science and Engineering (ICSSE), 2010 International Conference, 17 (3), 619-624.

Choi, H., Lee, H., Lee, H., & Kim, H. (2007). Botnet detection by monitoring group activities in DNS traffic. In Computer and Information Technology, 2007. CIT 2007. 7th IEEE International Conference, 12(5), 715-720.

Fedynyshyn, G., Chuah, M. C., & Tan, G. (2011). Detection and classification of different botnet C&C channels. In Autonomic and Trusted Computing, 15(4), 228-242.

Feily, M., Shahrestani, A., & Ramadass, S. (2009). A survey of botnet and botnet detection. In Emerging Security Information, Systems and Technologies, 2009. SECURWARE’09. Third International Conference, 38(4), 268-273.

Gough, J. (2005, March). Virtual machines, managed code and component technology. In Software Engineering Conference, 2005. Proceedings. 2005 Australian, 8(4), 5-12.

Govil, J., & Govil, J. (2007). Criminology of botnets and their detection and defense methods. In Electro/Information Technology, 2007 IEEE International Conference, 8(4), 215-220.

Gu, G., Perdisci, R., Zhang, J., & Lee, W. (2008, July). BotMiner: Clustering Analysis of Network Traffic for Protocol-and Structure-Independent Botnet Detection. In USENIX Security Symposium, 5(2), 139-154.

Gu, G., Zhang, J., & Lee, W. (2008). BotSniffer: Detecting botnet command and control channels in network traffic. In Proceedings of the 15th Annual Network and Distributed System Security Symposium, 8(4), 215-220.

Gandotra, E., Bansal, D., & Sofat, S. (2014). Malware analysis and classification: A survey. Journal of Information Security,5(2), 56-64. Retrieved March 12, 2012, from http://search.proquest.com/docview/1518645705?accountid=14526.

Ianelli, N., & Hackworth, A. (2005). Botnets as a vehicle for online crime. CERT Coordination Center, 1(2), 28-29.

Jang, D. I., Kim, M., Jung, H. C., & Noh, B. N. (2009). Analysis of HTTP P2P botnet: case study waledac. In Communications (MICC), 2009 IEEE 9th Malaysia International Conference, 5(2), 409-412.

Lee, J. S., Jeong, H., Park, J. H., Kim, M., & Noh, B. N. (2008). The activity analysis of malicious http-based botnets using degree of periodic repeatability. In Security Technology, 2008. SECTECH'08. International Conference, 5(2), 83-86.
Li, C., Jiang, W., & Zou, X. (2009, December). Botnet: Survey and case study. In Innovative Computing, Information and Control (ICICIC), 2009 Fourth International Conference, 5(2), 1184-1187.

Livadas, C., Walsh, R., Lapsley, D., & Strayer, W. T. (2006, November). Using machine learning techniques to identify botnet traffic. In Local Computer Networks, Proceedings 2006 31st IEEE Conference, 3(2), 967-974.

Mazzariello, C. (2008, September). IRC traffic analysis for botnet detection. InInformation Assurance and Security, 2008. ISIAS'08. Fourth International Conference, 2(2), 318-323.

Perdisci, R., Lee, W., & Feamster, N. (2010, April). Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces. In NSDI , 5(2), 391-404.

Saad, S., Traore, I., Ghorbani, A., Sayed, B., Zhao, D., Lu, W., ... & Hakimian, P. (2011). Detecting P2P botnets through network behavior analysis and machine learning. In Privacy, Security and Trust (PST), 2011 Ninth Annual International Conference on, 5(2), 174-180.

Strayer, W. T., Lapsely, D., Walsh, R., & Livadas, C. (2008). Botnet detection based on network behavior. In Botnet Detection, 5(2), 1-24.

Vania, J., Meniya, A., & Jethva, H. B. (2013). A Review on Botnet and Detection Technique. International Journal of Computer Trends and Technology, 5(4), 23-29.

Wang, P., Sparks, S., & Zou, C. C. (2010). An advanced hybrid peer-to-peer botnet. Dependable and Secure Computing, IEEE Transactions on, 7(2), 113-127.

Wang, P., Wu, L., Aslam, B., & Zou, C. C. (2009). A systematic study on peer-to-peer botnets. In Computer Communications and Networks, 2009. ICCCN 2009. Proceedings of 18th Internatonal Conference on, 5(2), 1-8.

Xie, Y., Yu, F., Achan, K., Panigrahy, R., Hulten, G., & Osipkov, I. (2008). Spamming botnets: signatures and characteristics. ACM SIGCOMM Computer Communication Review, 38(4), 171-182.Zeidanloo, H. R., & Manaf, A. A. (2009, December). Botnet command and control mechanisms. In Computer and Electrical Engineering, 2009. ICCEE’09. Second International Conference on, 1(2), 564-568.

Zeidanloo, H. R., Bt Manaf, A., Vahdani, P., Tabatabaei, F., & Zamani, M. (2010, June). Botnet detection based on traffic monitoring. In Networking and Information Technology (ICNIT), 2010 International Conference on, 1(2), 97-101.

Zeidanloo, H. R., Hosseinpour, F., & Borazjani, P. N. (2010, October). Botnet detection based on common network behaviors by utilizing artificial immune system (AIS). In Software Technology and Engineering (ICSTE), 2010 2nd International Conference on, 2(2), 1-21.

Zeidanloo, H. R., Shooshtari, M. J. Z., Amoli, P. V., Safari, M., & Zamani, M. (2010, July). A taxonomy of botnet detection techniques. In Computer Science and Information Technology (ICCSIT), 2010 3rd IEEE International Conference on, 3(2), 158-162.

Zou, C. C., & Cunningham, R. (2006). Honeypot-aware advanced botnet construction and maintenance. In Dependable Systems and Networks, 2006. DSN 2006. International Conference on, 5(1), 199-208.