Method for Effective Measurement, Labeling, and Classification of Botnet C2s for Predicting Attacks
Mitsuhiro Hatada, Matthew A. Scholl
In the IoT era, botnet threats are rising, which has prompted many studies on botnet detection. This study aims to detect the early signs of botnet attacks such as massive spam emails and Distributed Denial-of-Service attacks. To that end, this study develops a practical framework for measurement, labeling, and classification of botnet Command and Control (C2) for predicting attacks. The focus is on C2 traffic and measurement of the comprehensive metrics studied in previous works. The data is labeled based on the result of the correlation analysis between C2 metrics and spam volume. Then, a special type of recurrent neural network, i.e., Long Short- Term Memory, is applied to detect an increase in spam by a botnet. The framework managed to detect it with an accuracy of 0.981.
February 23-26, 2020
San Diego, CA
27th Annual Network and Distributed System Security Symposium (NDSS)