ZUNINO SUAREZ Alejandro Octavio
congresos y reuniones científicas
Botnet Behavior Detection using Network Synchronism
GARCIA, S.; ZUNINO, A.; CAMPO, M.
Simposio; 11th Argentine Symposium on Computing Technology (AST2010), 39 Jornadas Argentinas de Informática e Investigación Operativa (JAIIO); 2010
Botnets diversity and dynamism challenge detection and classifica- tion algorithms, which depend heavily on botnets protocol and can quickly become avoidable. A more general detection method, then, was needed. We propose an analysis of their most inherent characteristics, like synchronism and network load combined with a detailed analysis of error rates. Not relying in any specific botnet technology or protocol, our classification approach sought to detect synchronic behavioral patterns in network traffic flows and clustered them based on botnets characteristics. Different botnet and normal captures were taken and a time slice approach was used to successfully separate them. Results show that botnets and normal computers traffic can be accurately detected by our approach and thus enhance detection effectiveness.