Adaptive pattern mining model for early detection of botnet-propagation scale
- Authors
- Kim, Do Hoon; Lee, Taek; Kang, Jaewoo; Jeong, Hyunchoel; In, Hoh Peter
- Issue Date
- 8월-2012
- Publisher
- WILEY-HINDAWI
- Keywords
- botnet propagation; early detection; port scanning; hidden Markov model; simple text classifiers
- Citation
- SECURITY AND COMMUNICATION NETWORKS, v.5, no.8, pp.917 - 927
- Indexed
- SCIE
SCOPUS
- Journal Title
- SECURITY AND COMMUNICATION NETWORKS
- Volume
- 5
- Number
- 8
- Start Page
- 917
- End Page
- 927
- URI
- https://scholar.korea.ac.kr/handle/2021.sw.korea/107747
- DOI
- 10.1002/sec.366
- ISSN
- 1939-0114
- Abstract
- Botnets are a disastrous threat because they execute malicious activities such as distributed denial-of-service, spam email, malware downloads (such as eggdownloads), and spying by exploiting zombie PCs under their control. Botnets infect PCs on a huge scale by initially scanning the service ports of vulnerable applications for the purpose of propagation, which is leveraged as the size of the botnet increases. Therefore, it is of crucial importance to detect botnet-propagation activities early and to determine the expectedsize of the attack. To address this issue, this paper proposes to recreate botnets' port-scanning patterns using a simple text classifier that represents these patterns as a kind of matrix. The patterns obtained are then used to train a hidden Markov model and to perform early detection using the trained model. Early detection is achievable by catching the onset of suspicious propagation immediately, and a size estimate is obtained by monitoring fluctuations in botnet size. With this approach, early-detection rates increased to more than 30.6% on average, with a low false negative rate (less than 6%) and an F-measure greater than 96%. This significant improvement in performance will contribute to preventing botnet propagation in its earliest stages. Copyright (C) 2011 John Wiley & Sons, Ltd.
- Files in This Item
- There are no files associated with this item.
- Appears in
Collections - Graduate School > Department of Computer Science and Engineering > 1. Journal Articles
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.