Adaptive pattern mining model for early detection of botnet-propagation scale

Do Hoon Kim, Taek Lee, Jaewoo Kang, Hyunchoel Jeong, Hoh Peter In

Research output: Contribution to journalArticlepeer-review

4 Citations (Scopus)

Abstract

Botnets are a disastrous threat because they execute malicious activities such as distributed denial-of-service, spam email, malware downloads (such as eggdownloads), and spying by exploiting zombie PCs under their control. Botnets infect PCs on a huge scale by initially scanning the service ports of vulnerable applications for the purpose of propagation, which is leveraged as the size of the botnet increases. Therefore, it is of crucial importance to detect botnet-propagation activities early and to determine the expectedsize of the attack. To address this issue, this paper proposes to recreate botnets' port-scanning patterns using a simple text classifier that represents these patterns as a kind of matrix. The patterns obtained are then used to train a hidden Markov model and to perform early detection using the trained model. Early detection is achievable by catching the onset of suspicious propagation immediately, and a size estimate is obtained by monitoring fluctuations in botnet size. With this approach, early-detection rates increased to more than 30.6% on average, with a low false negative rate (less than 6%) and an F-measure greater than 96%. This significant improvement in performance will contribute to preventing botnet propagation in its earliest stages.

Original languageEnglish
Pages (from-to)917-927
Number of pages11
JournalSecurity and Communication Networks
Volume5
Issue number8
DOIs
Publication statusPublished - 2012 Aug

Keywords

  • Botnet propagation
  • Early detection
  • Hidden Markov model
  • Port scanning
  • Simple text classifiers

ASJC Scopus subject areas

  • Information Systems
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'Adaptive pattern mining model for early detection of botnet-propagation scale'. Together they form a unique fingerprint.

Cite this