Encrypted botnet
211031590
A Framework for Detecting Botnet Command and Control Communication over an Encrypted Channel
Botnet employs advanced evasion techniques to avoid detection. One of the Botnet evasion techniques is by hiding their command and control communication over an encrypted channel like SSL and TLS. This paper provides a Botnet Analysis and Detection System (BADS) framework for detecting Botnet. The BADS framework has been used as a guideline to devise the methodology, and we divided this methodology into six phases: i. data collection, customization, and conversion, ii. feature extraction and feature selection, iii. Botnet prediction and classification, iv. Botnet detection, v. attack notification, and vi. testing and evaluation. We tend to use the machine learning algorithm for Botnet prediction and classification. We also found several challenges in implementing this work. This research aims to detect Botnet over an encrypted channel with high accuracy, fast detection time, and provides autonomous management to the network manager.
Zahian Ismail Aman Bin Jantan Mohd Najwadi
229023788
The effects of feature selection on the classification of encrypted botnet
Many applications today are using an encrypted channel to secure their communication and transactions. Though, their security is often challenged by adversaries such as Botnet. Botnet leverages the encrypted channel to launch attacks and amplify the impact of attacks. The numbers of Botnet attacks over an encrypted channel are increasing and continue to cause a great loss of money. This study proposes an encrypted Botnet detection technique based on packet header analysis. This technique does not require deep packet inspection and intense traffic analysis. However, the proposed technique requires the analysis of the features taken from the packet header, which are essential for detection. The study endeavors to show that features selected can significantly affect the classification of encrypted Botnet. Therefore, in this paper, the researchers focus on the effects of feature selection on the classification of encrypted Botnet. The researchers use different classification mode (full training and 10 fold cross validation) mainly by using seven features (7 features) and three features (3 features) Seven features are the number of features extracted from the packet header, and after the feature selection, only three features out of the seven features have weight (value) Therefore, the three features are the most significant features from the seven features that have been extracted. Generally, the result shows that classification with three most significant features provides higher true positive compared to the 7 features classification. Different machine learning algorithms have been used for the classification. Relatively, the results show that the True Positives are higher for 3 features classification than 7 features classification.
J. Comput. Virol. Hacking Tech.
Zahian Ismail Aman Bin Jantan Mohd Najwadi Yusoff Muhammad Ubale Kiru
202577885
Encrypted and Covert DNS Queries for Botnets: Challenges and Countermeasures
There is a continuous increase in the sophistication that modern malware exercise in order to bypass the deployed security mechanisms. A typical approach to evade the identification and potential take down of a botnet command and control server is domain fluxing through the use of Domain Generation Algorithms (DGAs) These algorithms produce a vast amount of domain names that the infected device tries to communicate with to find the C&C server, yet only a small fragment of them is actually registered. This allows the botmaster to pivot the control and make the work of seizing the botnet control rather difficult. Current state of the art and practice considers that the DNS queries performed by a compromised device are transparent to the network administrator and therefore can be monitored, analysed, and blocked. In this work, we showcase that the latter is a strong assumption as malware could efficiently hide its DNS queries using covert and/or encrypted channels bypassing the detection mechanisms. To this end, we discuss possible mitigation measures based on traffic analysis to address the new challenges that arise from this approach.
Comput. Secur.
Constantinos Patsakis Fran Casino Vasilios Katos
231645488
BotEye: Botnet Detection Technique Via Traffic Flow Analysis Using Machine Learning Classifiers
Botnet is a prevalent threat among the Internet that always keep on proliferating. They can mow down an entire network within a blink of an eye. Different detection techniques have been proposed to detect botnets but botmasters always keep on revamping these botnets making it onerous for detection techniques that are based on command and control (C&C) protocols and structures. Botnets also utilize encrypted communication during their propagation. As a result, a technique irrespective of the protocols and propagation mechanisms used needs to be developed. Also, the technique should be able to detect encrypted botnets. In this paper, BotEye is proposed that is a botnet detection technique based on the traffic flow behavior of the network. The fringe benefit of using a flow based approach is that only a fraction of the total network traffic flow needs to be analyzed. The technique suggested is heedless towards the C&C protocols and structures used. It can even detect encrypted botnets as it is independent of the payload information. BotEye makes use of four features to differentiate between malicious and benign traffic. Furthermore, BotEye is evaluated against the CTU 13 dataset, using three different machine learning classifiers that incorporates a stratified 10 fold cross validation technique. The evaluation process shows that BotEye achieved the best results, i.e. 98.5% accuracy along with a low false positive rate when the time window is set at 240s.
2020 Sixth International Conference on Parallel, Distributed and Grid Computing (PDGC)
Jagdish R Yadav Jawahar Thakur
212703680
Detecting Malign Encrypted Network Traffic Using Perlin Noise and Convolutional Neural Network
Machine learning supports analysis of traffic packets by featuring the payloads, increasing the chances of detecting new variants of malware. However, adversaries take advantage of current cryptographically protected network communication to hide the payload features and as a result, avoid detection. In this research, we propose a new method enhancing generalization of Convolutional Neural Networks model to detect malicious encrypted network traffic. Since the payload is encrypted, we extract contextual features from the connection meta data that best characterizes the behavior of traffics. Our proposed approach encodes given connection features into images using Perlin noise to train the deep learning model for binary classification of connection flows. We applied the model to captured real botnet traffic dataset mixed with normal and background traffic, and obtained a high accuracy of 97% detection and low false negative rate of 0.4%
2020 10th Annual Computing and Communication Workshop and Conference (CCWC)
Wajdi Bazuhair Woo-jin Lee
220872217
DoH Insight: detecting DNS over HTTPS by machine learning
Over the past few years, a new protocol DNS over HTTPS (DoH) has been created to improve users' privacy on the internet. DoH can be used instead of traditional DNS for domain name translation with encryption as a benefit. This new feature also brings some threats because various security tools depend on readable information from DNS to identify, e.g. malware, botnet communication, and data exfiltration. Therefore, this paper focuses on the possibilities of encrypted traffic analysis, especially on the accurate recognition of DoH. The aim is to evaluate what information (if any) can be gained from HTTPS extended IP flow data using machine learning. We evaluated five popular ML methods to find the best DoH classifiers. The experiments show that the accuracy of DoH recognition is over 99.9 Additionally, it is also possible to identify the application that was used for DoH communication, since we have discovered (using created datasets) significant differences in the behavior of Firefox, Chrome, and cloudflared. Our trained classifier can distinguish between DoH clients with the 99.9 accuracy.
ARES
Dmitrii Vekshin Karel Hynek Tomas Cejka
221617675
P2P BOT DETECTION USING DEEP LEARNING WITH TRAFFIC REDUCTION SCHEMA
Nowadays, Botnet detection plays a vital role in assuring of information and internet security. This research introduces a scheme for peer to peer Botnet detection using a deep neural network in collaboration with the features selection approach. A classification and regression tree, ReliefF algorithm, and principal component analysis are utilized to choose the most significant features, and a deep neural network model is built based on adaptive learning methods (ADAM) The approach used in the proposed system utilizes network traffic alone, and the packet payload does not influence it, thus, avoids inherent shortcomings, such as the failure to handle encrypted payloads, as well as, preventing unknown malware from being addressed with rule based antivirus software to be combated. This study compares the proposed model with classical machine learning methods like Gaussian NB, Logistic regression, SVM and Random Forest. The experiment results note that the proposed deep neural network model achieve the best performance with a principal component analysis as a features selection method. From the experimental results, the proposed method reached the accuracy of 98.2% along with 0.015 false positive rate and 0.64 Root mean square error. Keyword: P2P Network, Botnet, Intrusion Detection, Deep Learning, Traffic Reduction.
Mohammad Alauthman
225841025
A Systematic Way to Implement Private Tor Network with Trusted Middle Node
Initially, legitimate users were working under a normal web browser to do all activities over the internet [1] To get more secure service and to get protection against Bot activity, the legitimate users switched their activity from Normal web browser to low latency anonymous communication such as Tor Browser. The Traffic monitoring in Tor Network is difficult as the packets are traveling from source to destination in an encrypted fashion and the Tor network hides its identity from destination. But lately, even the illegitimate users such as attackers/criminals started their activity on the Tor browser. The secured Tor network makes the detection of Botnet more difficult. The existing tools for botnet detection became inefficient against Tor based bots because of the features of the Tor browser. As the Tor Browser is highly secure and because of the ethical issues, doing practical experiments on it is not advisable which could affect the performance and functionality of the Tor browser. It may also affect the endanger users in situations where the failure of Tor's anonymity has severe consequences. So, in the proposed research work, Private Tor Networks (PTN) on physical or virtual machines with dedicated resources have been created along with Trusted Middle Node. The motivation behind the trusted middle node is to make the Private Tor network more efficient and to increase its performance.
2020 International Conference for Emerging Technology (INCET)
Yogita Deepak Mane Uday Pandit Khot
35187639
Deep packet: a novel approach for encrypted traffic classification using deep learning
Network traffic classification has become more important with the rapid growth of Internet and online applications. Numerous studies have been done on this topic which have led to many different approaches. Most of these approaches use predefined features extracted by an expert in order to classify network traffic. In contrast, in this study, we propose a deep learning based approach which integrates both feature extraction and classification phases into one system. Our proposed scheme, called "Deep Packet," can handle both traffic characterization in which the network traffic is categorized into major classes (e.g. FTP and P2P) and application identification in which identifying end user applications (e.g. BitTorrent and Skype) is desired. Contrary to most of the current methods, Deep Packet can identify encrypted traffic and also distinguishes between VPN and non VPN network traffic. The Deep Packet framework employs two deep neural network structures, namely stacked autoencoder (SAE) and convolution neural network (CNN) in order to classify network traffic. Our experiments show that the best result is achieved when Deep Packet uses CNN as its classification model where it achieves recall of 0.98 in application identification task and 0.94 in traffic categorization task. To the best of our knowledge, Deep Packet outperforms all of the proposed classification methods on UNB ISCX VPN nonVPN dataset.
Soft Comput.
Mohammad-agha Lotfollahi Ramin Shirali Hossein Zade Mahdi Jafari Siavoshani Mohammdsadegh Saberian
51939749
Peek a boo: i see your smart home activities, even encrypted!
A myriad of IoT devices such as bulbs, switches, speakers in a smart home environment allow users to easily control the physical world around them and facilitate their living styles through the sensors already embedded in these devices. Sensor data contains a lot of sensitive information about the user and devices. However, an attacker inside or near a smart home environment can potentially exploit the innate wireless medium used by these devices to exfiltrate sensitive information from the encrypted payload (i.e. sensor data) about the users and their activities, invading user privacy. With this in mind, in this work, we introduce a novel multi stage privacy attack against user privacy in a smart environment. It is realized utilizing state of the art machine learning approaches for detecting and identifying the types of IoT devices, their states, and ongoing user activities in a cascading style by only passively sniffing the network traffic from smart home devices and sensors. The attack effectively works on both encrypted and unencrypted communications. We evaluate the efficiency of the attack with real measurements from an extensive set of popular off the shelf smart home IoT devices utilizing a set of diverse network protocols like WiFi, ZigBee, and BLE. Our results show that an adversary passively sniffing the traffic can achieve very high accuracy (above 90% in identifying the state and actions of targeted smart home devices and their users. To protect against this privacy leakage, we also propose a countermeasure based on generating spoofed traffic to hide the device states and demonstrate that it provides better protection than existing solutions.
WISEC
Abbas Acar Hossein Fereidooni Tigist Abera Amit Kumar Sikder Markus Miettinen Hidayet Aksu Mauro Conti Ahmad-Reza Sadeghi Arif Selcuk Uluagac