The early bird gets the Botnet: a Markov chain based early warning system for Botnet attacks

Zainab Abaid; Dilip Sarkar; Mohamed Ali Kaafar; Sanjay Jha

doi:10.1109/LCN.2016.17

The early bird gets the Botnet: a Markov chain based early warning system for Botnet attacks

Zainab Abaid, Dilip Sarkar, Mohamed Ali Kaafar, Sanjay Jha

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

16 Citations (Scopus)

Abstract

Botnet threats include a plethora of possible attacks ranging from distributed denial of service (DDoS), to drive-by-download malware distribution and spam. While for over two decades, techniques have been proposed for either improving accuracy or speeding up the detection of attacks, much of the damage is done by the time attacks are contained. In this work we take a new direction which aims to predict forthcoming attacks (i.e. before they occur), providing early warnings to network administrators who can then prepare to contain them as soon as they manifest or simply quarantine hosts. Our approach is based on modelling the Botnet infection sequence as a Markov chain with the objective of identifying behaviour that is likely to lead to attacks. We present the results of applying a Markov model to real world Botnets' data, and show that with this approach we are successfully able to predict more than 98% of attacks from a variety of Botnet families with a very low false alarm rate.

Original language	English
Title of host publication	IEEE 41st Conference on Local Computer Networks, LCN 2016
Subtitle of host publication	proceedings
Place of Publication	Piscataway
Publisher	Institute of Electrical and Electronics Engineers (IEEE)
Pages	61-68
Number of pages	8
ISBN (Electronic)	9781509020546
ISBN (Print)	9781509020553
DOIs	https://doi.org/10.1109/LCN.2016.17
Publication status	Published - 22 Dec 2016
Externally published	Yes
Event	41st IEEE Conference on Local Computer Networks, LCN 2016 - Dubai, United Arab Emirates Duration: 7 Nov 2016 → 10 Nov 2016

Conference

Conference	41st IEEE Conference on Local Computer Networks, LCN 2016
Country/Territory	United Arab Emirates
City	Dubai
Period	7/11/16 → 10/11/16

Keywords

attack prediction
Botnet
Markov chain

Access to Document

10.1109/LCN.2016.17

Cite this

@inproceedings{6f87d5099a514b949b460cfc17a0cead,

title = "The early bird gets the Botnet: a Markov chain based early warning system for Botnet attacks",

abstract = "Botnet threats include a plethora of possible attacks ranging from distributed denial of service (DDoS), to drive-by-download malware distribution and spam. While for over two decades, techniques have been proposed for either improving accuracy or speeding up the detection of attacks, much of the damage is done by the time attacks are contained. In this work we take a new direction which aims to predict forthcoming attacks (i.e. before they occur), providing early warnings to network administrators who can then prepare to contain them as soon as they manifest or simply quarantine hosts. Our approach is based on modelling the Botnet infection sequence as a Markov chain with the objective of identifying behaviour that is likely to lead to attacks. We present the results of applying a Markov model to real world Botnets' data, and show that with this approach we are successfully able to predict more than 98% of attacks from a variety of Botnet families with a very low false alarm rate.",

keywords = "attack prediction, Botnet, Markov chain",

author = "Zainab Abaid and Dilip Sarkar and Kaafar, {Mohamed Ali} and Sanjay Jha",

year = "2016",

month = dec,

day = "22",

doi = "10.1109/LCN.2016.17",

language = "English",

isbn = "9781509020553",

pages = "61--68",

booktitle = "IEEE 41st Conference on Local Computer Networks, LCN 2016",

publisher = "Institute of Electrical and Electronics Engineers (IEEE)",

address = "United States",

note = "41st IEEE Conference on Local Computer Networks, LCN 2016 ; Conference date: 07-11-2016 Through 10-11-2016",

}

Abaid, Z, Sarkar, D, Kaafar, MA & Jha, S 2016, The early bird gets the Botnet: a Markov chain based early warning system for Botnet attacks. in IEEE 41st Conference on Local Computer Networks, LCN 2016: proceedings., 7796763, Institute of Electrical and Electronics Engineers (IEEE), Piscataway, pp. 61-68, 41st IEEE Conference on Local Computer Networks, LCN 2016, Dubai, United Arab Emirates, 7/11/16. https://doi.org/10.1109/LCN.2016.17

The early bird gets the Botnet: a Markov chain based early warning system for Botnet attacks. / Abaid, Zainab; Sarkar, Dilip; Kaafar, Mohamed Ali et al.
IEEE 41st Conference on Local Computer Networks, LCN 2016: proceedings. Piscataway: Institute of Electrical and Electronics Engineers (IEEE), 2016. p. 61-68 7796763.

Research output: Chapter in Book/Report/Conference proceeding › Conference proceeding contribution › peer-review

TY - GEN

T1 - The early bird gets the Botnet

T2 - 41st IEEE Conference on Local Computer Networks, LCN 2016

AU - Abaid, Zainab

AU - Sarkar, Dilip

AU - Kaafar, Mohamed Ali

AU - Jha, Sanjay

PY - 2016/12/22

Y1 - 2016/12/22

N2 - Botnet threats include a plethora of possible attacks ranging from distributed denial of service (DDoS), to drive-by-download malware distribution and spam. While for over two decades, techniques have been proposed for either improving accuracy or speeding up the detection of attacks, much of the damage is done by the time attacks are contained. In this work we take a new direction which aims to predict forthcoming attacks (i.e. before they occur), providing early warnings to network administrators who can then prepare to contain them as soon as they manifest or simply quarantine hosts. Our approach is based on modelling the Botnet infection sequence as a Markov chain with the objective of identifying behaviour that is likely to lead to attacks. We present the results of applying a Markov model to real world Botnets' data, and show that with this approach we are successfully able to predict more than 98% of attacks from a variety of Botnet families with a very low false alarm rate.

AB - Botnet threats include a plethora of possible attacks ranging from distributed denial of service (DDoS), to drive-by-download malware distribution and spam. While for over two decades, techniques have been proposed for either improving accuracy or speeding up the detection of attacks, much of the damage is done by the time attacks are contained. In this work we take a new direction which aims to predict forthcoming attacks (i.e. before they occur), providing early warnings to network administrators who can then prepare to contain them as soon as they manifest or simply quarantine hosts. Our approach is based on modelling the Botnet infection sequence as a Markov chain with the objective of identifying behaviour that is likely to lead to attacks. We present the results of applying a Markov model to real world Botnets' data, and show that with this approach we are successfully able to predict more than 98% of attacks from a variety of Botnet families with a very low false alarm rate.

KW - attack prediction

KW - Botnet

KW - Markov chain

UR - http://www.scopus.com/inward/record.url?scp=85010064676&partnerID=8YFLogxK

U2 - 10.1109/LCN.2016.17

DO - 10.1109/LCN.2016.17

M3 - Conference proceeding contribution

AN - SCOPUS:85010064676

SN - 9781509020553

SP - 61

EP - 68

BT - IEEE 41st Conference on Local Computer Networks, LCN 2016

PB - Institute of Electrical and Electronics Engineers (IEEE)

CY - Piscataway

Y2 - 7 November 2016 through 10 November 2016

ER -

The early bird gets the Botnet: a Markov chain based early warning system for Botnet attacks

Abstract

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this