Publication detail

Botnet C&C Traffic and Flow Lifespans Using Survival Analysis

OUJEZSKÝ, V. HORVÁTH, T. ŠKORPIL, V.

Original Title

Botnet C&C Traffic and Flow Lifespans Using Survival Analysis

Czech Title

Botnet C&C provoz a životnost toku pomocí analýzy přežití

English Title

Botnet C&C Traffic and Flow Lifespans Using Survival Analysis

Type

journal article

Language

en

Original Abstract

This paper addresses the issue of detecting unwanted traffic in data networks, namely the detection of botnet networks. In this paper, we focused on a time behavioral analysis, more specifically said – lifespans of a simulated botnet network traffic, collected and discovered from NetFlow messages, and also of real botnet communication of a malware. As a method we chose survival analysis and for rigorous testing of differences Mantel–Cox test. Lifespans of those referred traffics are discovered and calculated by lifelines using Python language. Based on our research we have figured out a possibility to distinguish the individual lifespans of C&C communications that are identical to each other by using survival projection curves, although it occurred in a different time course.

Czech abstract

Tento dokument řeší problém detekce nežádoucích dat v datových sítích, zejména zjištění botnet sítě. Tento článek se zaměřuje na časovou behaviorální analýzy, konkrétně řečeno – životnost simulovaného botnet síťového přenosu, shromážděn pomocí NetFlow zpráv. Dále je také zaměřen na komunikaci skutečné botnet sítě. Jako metodu jsme zvolili analýzu přežití a testování rozdílů pomocí Mantel-Cox testu. Životnost těchto uvedených síťových provozů je zkoumána pomocí balíčku lifelines jazyka Python. Na základě našeho výzkumu jsme zjistili možnost rozlišovat jednotlivé životnosti C&C komunikace, které jsou navzájem shodné, a to pomocí projekce křivky přežití, i když k ní došlo v jiném časovém průběhu.

English abstract

This paper addresses the issue of detecting unwanted traffic in data networks, namely the detection of botnet networks. In this paper, we focused on a time behavioral analysis, more specifically said – lifespans of a simulated botnet network traffic, collected and discovered from NetFlow messages, and also of real botnet communication of a malware. As a method we chose survival analysis and for rigorous testing of differences Mantel–Cox test. Lifespans of those referred traffics are discovered and calculated by lifelines using Python language. Based on our research we have figured out a possibility to distinguish the individual lifespans of C&C communications that are identical to each other by using survival projection curves, although it occurred in a different time course.

Keywords

Botnet, Lifespans, Modeling, NetFlow, Survival, Analysis

Released

27.03.2017

Publisher

International Science and Engineering Society, o.s.

Location

Czech Republic

Pages from

38

Pages to

44

Pages count

7

URL

Full text in the Digital Library

BibTex


@article{BUT134474,
  author="Václav {Oujezský} and Tomáš {Horváth} and Vladislav {Škorpil}",
  title="Botnet C&C Traffic and Flow Lifespans Using Survival Analysis",
  annote="This paper addresses the issue of detecting unwanted traffic in data networks, namely the detection of botnet networks. In this paper, we focused on a time behavioral analysis, more specifically said – lifespans of a simulated botnet network traffic, collected and discovered from NetFlow messages, and also of real botnet communication of a malware. As a method we chose survival analysis and for rigorous testing of differences Mantel–Cox test. Lifespans of those referred traffics are discovered and calculated by lifelines using Python language.
Based on our research we have figured out a possibility to distinguish the individual lifespans of C&C communications that are identical to each other by using survival projection curves, although it occurred in a different time course.",
  address="International Science and Engineering Society, o.s.",
  chapter="134474",
  doi="10.11601/ijates.v6i1.205",
  howpublished="online",
  institution="International Science and Engineering Society, o.s.",
  number="1",
  volume="6",
  year="2017",
  month="march",
  pages="38--44",
  publisher="International Science and Engineering Society, o.s.",
  type="journal article"
}