Library Automation and Digital Archive
LONTAR
Fakultas Ilmu Komputer
Universitas Indonesia

Pencarian Sederhana

Find Similar Add to Favorite

Call Number SEM-305
Collection Type Indeks Artikel prosiding/Sem
Title Flow-based Identification of Botnet Traffic by Mining Multiple Log Files
Author Mohammad M.Masud,Tahseen Al-Khateeb,Latifur Khan;
Publisher PROCEEDINGS The First International Conference on Distributed Frameworks and Applications : DFmA 2008 21-22 October 2008,USM,Penang,Malaysia
Subject Malware,botnet,intrusion detection,data timing
Location
Lokasi : Perpustakaan Fakultas Ilmu Komputer
Nomor Panggil ID Koleksi Status
SEM-305 TERSEDIA
Tidak ada review pada koleksi ini: 41057
detection and distruption has been a major research topic in recent years.One effective technique for botnet detection is to identify Command and Control (C&C) traffic,which is sent from a C&C center to infected hosts (bots)to control the bots .If this traffic can be detected ,both the C&C center and the bots it controls can be detected and the botnet can be distrubted.We propose a multiple log-file based temporal correlation technique for detecting C&C traffic .Our main assumtion is that bots respon much faster than humans .By temporally correlating two host-based log files,we are able to detect this property and thereby detect bot activity in a host machine.In our experiments we apply this technique to log files produced by tcpdump and exedump,which record all incomming and outgoing network packets,and the start times pf application executions at the host machine,respectively.We apply data mining to extract relevant feature from these log files and detect C&C traffic.Our experimental results validate our assumption and show better overall performance when campared to other recently published technique.