INVESTIGADORES
ZUNINO SUAREZ Alejandro Octavio
congresos y reuniones científicas
Título:
Botnet Behavior Detection using Network Synchronism
Autor/es:
GARCIA, S.; ZUNINO, A.; CAMPO, M.
Lugar:
Buenos Aires
Reunión:
Simposio; 11th Argentine Symposium on Computing Technology (AST2010), 39 Jornadas Argentinas de Informática e Investigación Operativa (JAIIO); 2010
Institución organizadora:
SADIO
Resumen:
Botnets diversity and dynamism challenge detection and classifica- tion algorithms, which depend heavily on botnets protocol and can quickly become avoidable. A more general detection method, then, was needed. We propose an analysis of their most inherent characteristics, like synchronism and network load combined with a detailed analysis of error rates. Not relying in any specific botnet technology or protocol, our classification approach sought to detect synchronic behavioral patterns in network traffic flows and clustered them based on botnets characteristics. Different botnet and normal captures were taken and a time slice approach was used to successfully separate them. Results show that botnets and normal computers traffic can be accurately detected by our approach and thus enhance detection effectiveness.