Home > Research > Publications & Outputs > Analysis and characterisation of botnet scan tr...

Electronic data

  • ICNC_2016_botnets_crc

    Rights statement: ©2016 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.

    Accepted author manuscript, 686 KB, PDF document

    Available under license: CC BY: Creative Commons Attribution 4.0 International License

Links

Text available via DOI:

View graph of relations

Analysis and characterisation of botnet scan traffic

Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSNConference contribution/Paperpeer-review

Published

Standard

Analysis and characterisation of botnet scan traffic. / Marnerides, Angelos; Mauthe, Andreas Ulrich.

2016 International Conference on Computing, Networking and Communications (ICNC). IEEE, 2016. p. 1-7.

Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSNConference contribution/Paperpeer-review

Harvard

Marnerides, A & Mauthe, AU 2016, Analysis and characterisation of botnet scan traffic. in 2016 International Conference on Computing, Networking and Communications (ICNC). IEEE, pp. 1-7, International Conference on Computing, Networking and Communications, Kauai, Hawaii, United States, 15/02/16. https://doi.org/10.1109/ICCNC.2016.7440627

APA

Marnerides, A., & Mauthe, A. U. (2016). Analysis and characterisation of botnet scan traffic. In 2016 International Conference on Computing, Networking and Communications (ICNC) (pp. 1-7). IEEE. https://doi.org/10.1109/ICCNC.2016.7440627

Vancouver

Marnerides A, Mauthe AU. Analysis and characterisation of botnet scan traffic. In 2016 International Conference on Computing, Networking and Communications (ICNC). IEEE. 2016. p. 1-7 doi: 10.1109/ICCNC.2016.7440627

Author

Marnerides, Angelos ; Mauthe, Andreas Ulrich. / Analysis and characterisation of botnet scan traffic. 2016 International Conference on Computing, Networking and Communications (ICNC). IEEE, 2016. pp. 1-7

Bibtex

@inproceedings{02919a7b33334fca8aa689584d3775aa,
title = "Analysis and characterisation of botnet scan traffic",
abstract = "Botnets compose a major source of malicious activity over a network and their early identification and detection is considered as a top priority by security experts. The majority of botmasters rely heavily on a scan procedure in order to detect vulnerable hosts and establish their botnets via a command and control (C&C) server. In this paper we examine the statistical characteristics of the scan process invoked by the Mariposa and Zeus botnets and demonstrate the applicability of conditional entropy as a robust metric for profiling it using real pre-captured operational data. Our analysis conducted on real datasets demonstrates that the distributional behaviour of conditional entropy for Mariposa and Zeus-related scan flows differs significantly from flows manifested by the commonly used NMAP scans. In contrast with the typically used by attackers Stealth and Connect NMAP scans, we show that consecutive scanning flows initiated by the C&C servers of the examined botnets exhibit a high dependency between themselves in regards of their conditional entropy. Thus, we argue that the observation of such scan flows under our proposed scheme can sufficiently aid network security experts towards the adequate profiling and early identification of botnet activity.",
author = "Angelos Marnerides and Mauthe, {Andreas Ulrich}",
note = "{\textcopyright}2016 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.; International Conference on Computing, Networking and Communications ; Conference date: 15-02-2016 Through 18-02-2016",
year = "2016",
month = feb,
day = "15",
doi = "10.1109/ICCNC.2016.7440627",
language = "English",
isbn = "9781467385794",
pages = "1--7",
booktitle = "2016 International Conference on Computing, Networking and Communications (ICNC)",
publisher = "IEEE",

}

RIS

TY - GEN

T1 - Analysis and characterisation of botnet scan traffic

AU - Marnerides, Angelos

AU - Mauthe, Andreas Ulrich

N1 - ©2016 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.

PY - 2016/2/15

Y1 - 2016/2/15

N2 - Botnets compose a major source of malicious activity over a network and their early identification and detection is considered as a top priority by security experts. The majority of botmasters rely heavily on a scan procedure in order to detect vulnerable hosts and establish their botnets via a command and control (C&C) server. In this paper we examine the statistical characteristics of the scan process invoked by the Mariposa and Zeus botnets and demonstrate the applicability of conditional entropy as a robust metric for profiling it using real pre-captured operational data. Our analysis conducted on real datasets demonstrates that the distributional behaviour of conditional entropy for Mariposa and Zeus-related scan flows differs significantly from flows manifested by the commonly used NMAP scans. In contrast with the typically used by attackers Stealth and Connect NMAP scans, we show that consecutive scanning flows initiated by the C&C servers of the examined botnets exhibit a high dependency between themselves in regards of their conditional entropy. Thus, we argue that the observation of such scan flows under our proposed scheme can sufficiently aid network security experts towards the adequate profiling and early identification of botnet activity.

AB - Botnets compose a major source of malicious activity over a network and their early identification and detection is considered as a top priority by security experts. The majority of botmasters rely heavily on a scan procedure in order to detect vulnerable hosts and establish their botnets via a command and control (C&C) server. In this paper we examine the statistical characteristics of the scan process invoked by the Mariposa and Zeus botnets and demonstrate the applicability of conditional entropy as a robust metric for profiling it using real pre-captured operational data. Our analysis conducted on real datasets demonstrates that the distributional behaviour of conditional entropy for Mariposa and Zeus-related scan flows differs significantly from flows manifested by the commonly used NMAP scans. In contrast with the typically used by attackers Stealth and Connect NMAP scans, we show that consecutive scanning flows initiated by the C&C servers of the examined botnets exhibit a high dependency between themselves in regards of their conditional entropy. Thus, we argue that the observation of such scan flows under our proposed scheme can sufficiently aid network security experts towards the adequate profiling and early identification of botnet activity.

U2 - 10.1109/ICCNC.2016.7440627

DO - 10.1109/ICCNC.2016.7440627

M3 - Conference contribution/Paper

SN - 9781467385794

SP - 1

EP - 7

BT - 2016 International Conference on Computing, Networking and Communications (ICNC)

PB - IEEE

T2 - International Conference on Computing, Networking and Communications

Y2 - 15 February 2016 through 18 February 2016

ER -