The early bird gets the Botnet

a Markov chain based early warning system for Botnet attacks

Zainab Abaid, Dilip Sarkar, Mohamed Ali Kaafar, Sanjay Jha

Research output: Chapter in Book/Report/Conference proceedingConference proceeding contribution

2 Citations (Scopus)

Abstract

Botnet threats include a plethora of possible attacks ranging from distributed denial of service (DDoS), to drive-by-download malware distribution and spam. While for over two decades, techniques have been proposed for either improving accuracy or speeding up the detection of attacks, much of the damage is done by the time attacks are contained. In this work we take a new direction which aims to predict forthcoming attacks (i.e. before they occur), providing early warnings to network administrators who can then prepare to contain them as soon as they manifest or simply quarantine hosts. Our approach is based on modelling the Botnet infection sequence as a Markov chain with the objective of identifying behaviour that is likely to lead to attacks. We present the results of applying a Markov model to real world Botnets' data, and show that with this approach we are successfully able to predict more than 98% of attacks from a variety of Botnet families with a very low false alarm rate.

Original languageEnglish
Title of host publicationIEEE 41st Conference on Local Computer Networks, LCN 2016
Subtitle of host publicationproceedings
Place of PublicationPiscataway
PublisherInstitute of Electrical and Electronics Engineers (IEEE)
Pages61-68
Number of pages8
ISBN (Electronic)9781509020546
ISBN (Print)9781509020553
DOIs
Publication statusPublished - 22 Dec 2016
Externally publishedYes
Event41st IEEE Conference on Local Computer Networks, LCN 2016 - Dubai, United Arab Emirates
Duration: 7 Nov 201610 Nov 2016

Conference

Conference41st IEEE Conference on Local Computer Networks, LCN 2016
CountryUnited Arab Emirates
CityDubai
Period7/11/1610/11/16

Keywords

  • attack prediction
  • Botnet
  • Markov chain

Fingerprint Dive into the research topics of 'The early bird gets the Botnet: a Markov chain based early warning system for Botnet attacks'. Together they form a unique fingerprint.

  • Cite this

    Abaid, Z., Sarkar, D., Kaafar, M. A., & Jha, S. (2016). The early bird gets the Botnet: a Markov chain based early warning system for Botnet attacks. In IEEE 41st Conference on Local Computer Networks, LCN 2016: proceedings (pp. 61-68). [7796763] Piscataway: Institute of Electrical and Electronics Engineers (IEEE). https://doi.org/10.1109/LCN.2016.17