Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models
A botnet is a network of compromised computer systems, or bots, remotely controlled by an attacker through bot controllers. This covert network poses a threat through large-scale cyber attacks, including phishing, distributed denial of service (DDoS), data theft, and server crashes. Botnets often ca...
| 發表在: | Applied Sciences |
|---|---|
| Main Authors: | , |
| 格式: | Article |
| 語言: | 英语 |
| 出版: |
MDPI AG
2024-05-01
|
| 主題: | |
| 在線閱讀: | https://www.mdpi.com/2076-3417/14/10/4019 |
| _version_ | 1850380364015468544 |
|---|---|
| author | Rucha Mannikar Fabio Di Troia |
| author_facet | Rucha Mannikar Fabio Di Troia |
| author_sort | Rucha Mannikar |
| collection | DOAJ |
| container_title | Applied Sciences |
| description | A botnet is a network of compromised computer systems, or bots, remotely controlled by an attacker through bot controllers. This covert network poses a threat through large-scale cyber attacks, including phishing, distributed denial of service (DDoS), data theft, and server crashes. Botnets often camouflage their activity by utilizing common internet protocols, such as HTTP and IRC, making their detection challenging. This paper addresses this threat by proposing a method to identify botnets based on distinctive communication patterns between command and control servers and bots. Recognizable traits in botnet behavior, such as coordinated attacks, heartbeat signals, and periodic command distribution, are analyzed. Probabilistic models, specifically Hidden Markov Models (HMMs) and Profile Hidden Markov Models (PHMMs), are employed to learn and identify these activity patterns in network traffic data. This work utilizes publicly available datasets containing a combination of botnet, normal, and background traffic to train and test these models. The comparative analysis reveals that both HMMs and PHMMs are effective in detecting botnets, with PHMMs exhibiting superior accuracy in botnet detection compared to HMMs. |
| format | Article |
| id | doaj-art-e6fda94c383e49dc98da69a4bd89f5f5 |
| institution | Directory of Open Access Journals |
| issn | 2076-3417 |
| language | English |
| publishDate | 2024-05-01 |
| publisher | MDPI AG |
| record_format | Article |
| spelling | doaj-art-e6fda94c383e49dc98da69a4bd89f5f52025-08-19T22:57:46ZengMDPI AGApplied Sciences2076-34172024-05-011410401910.3390/app14104019Enhancing Botnet Detection in Network Security Using Profile Hidden Markov ModelsRucha Mannikar0Fabio Di Troia1Department of Computer Science, San Jose State University, One Washington Square, San Jose, CA 95192, USADepartment of Computer Science, San Jose State University, One Washington Square, San Jose, CA 95192, USAA botnet is a network of compromised computer systems, or bots, remotely controlled by an attacker through bot controllers. This covert network poses a threat through large-scale cyber attacks, including phishing, distributed denial of service (DDoS), data theft, and server crashes. Botnets often camouflage their activity by utilizing common internet protocols, such as HTTP and IRC, making their detection challenging. This paper addresses this threat by proposing a method to identify botnets based on distinctive communication patterns between command and control servers and bots. Recognizable traits in botnet behavior, such as coordinated attacks, heartbeat signals, and periodic command distribution, are analyzed. Probabilistic models, specifically Hidden Markov Models (HMMs) and Profile Hidden Markov Models (PHMMs), are employed to learn and identify these activity patterns in network traffic data. This work utilizes publicly available datasets containing a combination of botnet, normal, and background traffic to train and test these models. The comparative analysis reveals that both HMMs and PHMMs are effective in detecting botnets, with PHMMs exhibiting superior accuracy in botnet detection compared to HMMs.https://www.mdpi.com/2076-3417/14/10/4019network analysisbotnetsmalware detectionHidden Markov ModelsProfile Hidden Markov Models |
| spellingShingle | Rucha Mannikar Fabio Di Troia Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models network analysis botnets malware detection Hidden Markov Models Profile Hidden Markov Models |
| title | Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models |
| title_full | Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models |
| title_fullStr | Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models |
| title_full_unstemmed | Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models |
| title_short | Enhancing Botnet Detection in Network Security Using Profile Hidden Markov Models |
| title_sort | enhancing botnet detection in network security using profile hidden markov models |
| topic | network analysis botnets malware detection Hidden Markov Models Profile Hidden Markov Models |
| url | https://www.mdpi.com/2076-3417/14/10/4019 |
| work_keys_str_mv | AT ruchamannikar enhancingbotnetdetectioninnetworksecurityusingprofilehiddenmarkovmodels AT fabioditroia enhancingbotnetdetectioninnetworksecurityusingprofilehiddenmarkovmodels |