| As one of the most serious attacks on network security,botnets are being launchied various malicious activities by attackers,such as DDoS,spamming,bitcoin mining,extortion,fishing and so on.It not only causes huge economic losses to users,but also faces huge challenge in the field of network security.Therefore,it is essential to research how to detect botnets quickly and effectively.Although the researcher has developed a lots of methods based on flow-based network traffic analysis or based on graph-based network traffic analysis.As bots have continuously evolved and botnets become increasingly sophisticated,only using flow-based traffic analysis or graph-based analysis for the detection would result in false negatives or false positives,or can even be evaded.On the one hand,attackers can evade detection based on flow-based network traffic methods through various advanced technologies such as communication randomization,mimicry attacks and covert channel.On the other hand,the graph-based traffic behaviors are require to acquire all communication data packets in the entire network.In addition,the large and intricate network topology in real environment makes detection difficulty,low versatility and costly.The main contribution of this work are as follows:We study five newly propagated botnets in depth,including Mirai,BlackEnergy,Zeus,Athena and Ares.After building their environment,we simulated a total of 305 infected hosts and 5 C&C servers through Docker container teachnology.We employ Wireshark to capture the botnet traffic.Then we mix the background traffic with botnet traffic in order to obtain the entire experimental datasets.In this work,we used 203,066 hosts,the total number of captured packets is 456,229,550.This dissertation deeply analyzes the working principle,protocol and message communication mechanism of botnet.We emphasize the unique network traffic characteristics during bots communication with the C&C server.We proposed a botnet detection model based on the k-means clustering algorithm and the mutation frequency of packet size distribution vector,which combines the similarity method and the stability model through weighted linear combination to improve the accuracy and efficiency of botnet detection.The experimental results show that the similarity-based method with 98.36%in terms of true positive rate,higher than stability-based method.That proves our high-dimensional statistical features are effective.It is observed that the similarity-based method can identify the Zeus botnet absolutely,but Zeus botnet is unable to be identified by the stability-based method completely.Under the premise of guaranteeing a low false positive rate,the combination of the two models are able to detect more Zeus botnet,it can detecte 22 more Zeus botnet clients than stability-based method.We are motivated to mine the patterns that neighborhoods of normal nodes look like in large-scale network graphs.Combining anomalous neighborhoods significantly differ from normal neighborhoods,we proposed graph feature botnet detection model.More specifically,we analysis the feature pairs of the number of nodes,edges and weight,and we use least-square technique to fit a straight line and Local Outlier Factor to measure the anomalies of an ego.The experimental results show that graph method reaches accuracy with 91.66%.We design BotMark that automatically detects bots with hybrid analysis of flow-based and graph-based traffic behaviors.BotMark performs automated botnet detection with hybrid analysis of flow-based and graph-based traffic behaviors by ensemble of the detection results based on similarity scores,stability scores and anomaly scores.The experimental results show that detection accuracy of BotMark is 98.36%,while the false positive rate is 0.06%.BotMark achieves the 99.94%in terms of detection accuracy with hybrid analysis,outperforming any individual method.In addition,BotMark is independent of botnet Command and Control Server(C&C)protocol(IRC,HTTP)and structure(Centralized,peer-to-peer),requires no a priori knowledge of botnets,and thus can be adopted in complex networking environments. |
