Monsieur poirot: Detecting botnets using re-identification algorithm and nontrivial feature selection technique

Wei Min Lee, Amir Rezapour, Wen-Guey Tzeng

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Scopus citations

Abstract

Modern botnets are progressively migrating to P2P network to resist against take-down attempts. In addition, new botnets use randomization in their behavior to evade detection. In this paper, we propose a new method for detecting stealthy P2P bots. We formulate the problem as a re-identification problem. This opens the possibility of powerful instantiations of detection algorithms to address the botnet detection problem. We also use a nontrivial feature selection technique to discover the best feature pairs for conducting comparison between two flows. We use real-world botnet data to evaluate the performance of Monsieur Poirot and compare it with existing flow-based algorithms. Monsieur Poirot is robust towards injection of noise in the communication patterns. The experimental results show that Monsieur Poirot is able to identify P2P bots with an average TPR of 98.65% and an average FPR of 0.21%.

Original languageEnglish
Title of host publication2018 IEEE International Conference on Communications, ICC 2018 - Proceedings
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Print)9781538631805
DOIs
StatePublished - 27 Jul 2018
Event2018 IEEE International Conference on Communications, ICC 2018 - Kansas City, United States
Duration: 20 May 201824 May 2018

Publication series

NameIEEE International Conference on Communications
Volume2018-May
ISSN (Print)1550-3607

Conference

Conference2018 IEEE International Conference on Communications, ICC 2018
CountryUnited States
CityKansas City
Period20/05/1824/05/18

Fingerprint Dive into the research topics of 'Monsieur poirot: Detecting botnets using re-identification algorithm and nontrivial feature selection technique'. Together they form a unique fingerprint.

Cite this