Correlation-based Botnet Detection in Enterprise Networks

Most of the attacks and fraudulent activities on the Internet are carried out by malware. In particular, botnets, as state-of-the-art malware, are now considered as the largest threat to Internet security. In this thesis, we focus on addressing the botnet detection problem in an enterprise-like network environment. We present a comprehensive correlation-based framework for multi-perspective botnet detection consisting of detection technologies demonstrated in four complementary systems: BotHunter, BotSniffer, BotMiner, and BotProbe. The common thread of these systems is correlation analysis, i.e., vertical correlation (dialog correlation), horizontal correlation, and cause-effect correlation. All these Bot* systems have been evaluated in live networks and/or real-world network traces. The evaluation results show that they can accurately detect real-world botnets for their desired detection purposes with a very low false positive rate. We find that correlation analysis techniques are of particular value for detecting advanced malware such as botnets. Dialog correlation can be effective as long as malware infections need multiple stages. Horizontal correlation can be effective as long as malware tends to be distributed and coordinated. In addition, active techniques can greatly complement passive approaches, if carefully used. We believe our experience and lessons are of great benefit to future malware detection.

Department dc:contributor.department

Computing

Grantor dc:publisher

Georgia Institute of Technology

Year dc:date.issued

2008

Author dc:creator

• Gu, Guofei

Advisor dc:contributor.advisor

• Lee, Wenke

Committee members dc:contributor.committeemember

• Ahamad,Mustaque
• Feamster, Nick
• Giffin, Jonathon
• Ji,Chuanyi

• Malware detection
• Network security
• Anomaly detection
• Intrusion detection

Handle dc:identifier.uri

http://hdl.handle.net/1853/24634

OAI identifier oai:identifier

oai:repository.gatech.edu:1853/24634