ScholarLens Back to search
2015•Unpublished venueRequires access

Botnet tracing based on distributed denial of service activity analysis

Wei Ding, Wentao Ren, Zhen Xia, Li Wang

Open publisher page 2 citations

Abstract

Most of DDoS(Distributed Denial of Service) attacks use botnets as the carrier, which has become one of the serious threat to Internet. However, botnet detection is difficult in backbone because C&C(command & control channel) is blended into the heavy background traffic. This paper proposed a method for locating botnet by DDoS activity data analysis and DPI(Deep Packet Inspection) technology. The DDoS attack traffic is sampled to locate suspicious hosts firstly, then the hosts' packets are collected and analyzed by DPI technology with some DDoS parameters, such as victim, start time of the attack etc. for finding C&C and Servers. This detection model has been implemented, named BTS (Botnet tracking system) at a POP of CERNET. The tests showed the practicability of this model.

About this research paper

What this paper is about

Most of DDoS(Distributed Denial of Service) attacks use botnets as the carrier, which has become one of the serious threat to Internet. However, botnet detection is difficult in backbone because C&C(command & control channel) is blended into the heavy background traffic. This paper proposed a method for locating botnet by DDoS activity data analysis and DPI(Deep Packet Inspection) technology. The DDoS attack traffic is sampled to locate suspicious hosts firstly, then the hosts' packets are collected and analyzed by DPI technology with some DDoS parameters, such as victim, start time of the attack etc. for finding C&C and Servers. This detection model has been implemented, named BTS (Botnet tracking system) at a POP of CERNET. The tests showed the practicability of this model.

Why it matters

OpenAlex reports 2 citations for this work. Citation counts describe recorded attention and do not establish research quality.

Key contribution

A contribution statement is not available in the OpenAlex record.

Method / approach

Method details are not available in the OpenAlex metadata.

Main findings

Findings are not separately available in the OpenAlex metadata.

Limitations

Limitations are not available in the OpenAlex metadata.

Applications

Application details are not available in the OpenAlex metadata.

Available abstract

Most of DDoS(Distributed Denial of Service) attacks use botnets as the carrier, which has become one of the serious threat to Internet. However, botnet detection is difficult in backbone because C&C(command & control channel) is blended into the heavy background traffic. This paper proposed a method for locating botnet by DDoS activity data analysis and DPI(Deep Packet Inspection) technology. The DDoS attack traffic is sampled to locate suspicious hosts firstly, then the hosts' packets are collected and analyzed by DPI technology with some DDoS parameters, such as victim, start time of the attack etc. for finding C&C and Servers. This detection model has been implemented, named BTS (Botnet tracking system) at a POP of CERNET. The tests showed the practicability of this model.

Key concepts: Botnet, Denial-of-service attack, Trinoo, Application layer DDoS attack, Computer science, Server, Computer security, Network packet

Related papers

Related paper 1Related paper 2Related paper 3
Back to paper searchBrowse research topicsOriginal source
Botnet tracing based on distributed denial of service activity analysis — Research Paper | ScholarLens