A botnet is a large network of bots that are under the control of a bot herder. Botnets have become a significant threat to network communications and applications. Botnets' execution relies on Command and Control (C2) communication channels traffic, which occur prior to the attack activity itself. Therefore, the detection of C2 communication channels traffic enables the detection of the members of a botnet before any target is attacked. We study the periodic behavior of C2 traffic that is caused by the pre-programmed behavior of bots to check for and download updates every T seconds. We use this periodic behavior of the C2 traffic to detect bots. This involves evaluating the periodogram of traffic in the monitored network. Then applying Walker's large sample test to the maximum ordinate of the periodogram to determine if it is due to a high periodic component in the traffic or not, and, if it is, then it is bot traffic. We apply the test to a TinyP2P botnet generated by SLINGbot and show a strong periodic behavior in the bots traffic. We study the effect of the period's length and duty cycle of the C2 traffic on the test performance and find that it increases with the increase of the duty cycle and/or the decrease of the period length. We analyze the test's performance in the presence of injected random noise traffic and develop a lower and an upper bounds for the test performance.

Botnets pose a significant threat to network-based applications and communications; it is believed that 16-25% of the computers connected to the Internet are members of a botnet. The detection of botnets is essential to prevent further damages. We approach this problem by monitoring the command and control (C2) communication traffic, as this reveals the botnet structure before any real harm is caused.We observe that C2 traffic exhibits a repeated pattern behavior. This is due to the nature of the pre-programmed behavior of bots. We explore this behavior and look for periodic components in C2 traffic. We use periodograms to study the periodic behavior, and apply Walker's large sample test to detect whether the traffic has a significant periodic component or not, and, if it does, then it is bot traffic. This test is independent of the structure and communication protocol used in the botnet, and does not require any a priori knowledge of a certain botnet behavior. Since we only look at the aggregate traffic behavior, it is also more scalable than other techniques that examine individual packets or track the communication flows of different hosts.We apply this test to two variants of botnet C2 communication traffic generated by SLINGbot, and show that the traffic in both variants exhibits periodic behavior. We compare the results we get on botnet C2 communication traffic to the ones we get on real traffic that is obtained from a secured enterprise network packet trace.

To date, techniques to counter cyber-attacks have predominantly been reactive; they focus on monitoring network traffic, detecting anomalies and cyber-attack traffic patterns, and, a posteriori, combating the cyber-attacks and mitigating their effects. Contrary to such approaches, we advocate proactively detecting and identifying botnets prior to their being used as part of a cyber-attack (Strayer et al., 2006). In this paper, we present our work on using machine learning-based classification techniques to identify the command and control (C2) traffic of IRC-based botnets - compromised hosts that are collectively commanded using Internet relay chat (IRC). We split this task into two stages: (I) distinguishing between IRC and non-IRC traffic, and (II) distinguishing between botnet and real IRC traffic. For stage I, we compare the performance of J48, naive Bayes, and Bayesian network classifiers, identify the features that achieve good overall classification accuracy, and determine the classification sensitivity to the training set size. While sensitive to the training data and the attributes used to characterize communication flows, machine learning-based classifiers show promise in identifying IRC traffic. Using classification in stage II is trickier, since accurately labeling IRC traffic as botnet and non-botnet is challenging. We are currently exploring labeling flows as suspicious and non-suspicious based on telltales of hosts being compromised

Systems are attempting to detect botnets by examining traffic content for IRC commands or by setting up honeynets. Our approach for detecting botnets is to examine flow characteristics such as bandwidth, duration, and packet timing looking for evidence of botnet command and control activity. We have constructed an architecture that first eliminates traffic that is unlikely to be a part of a botnet, classifies the remaining traffic into a group that is likely to be part of a botnet, then correlates the likely traffic to find common communications patterns that would suggest the activity of a botnet. Our results show that botnet evidence can be extracted from a traffic trace containing almost 9 million flows

We propose an optimization based flow control for the Internet called random early marking (REM). In this paper we propose and evaluate an enhancement that attempts to speed up the convergence of REM in the face of large feedback delays. REM can be regarded as an implementation of an optimization algorithm in a distributed network. The basic idea is to treat the optimization algorithm as a discrete time system and apply linear control techniques to stabilize its transient. We show that the modified algorithm is stable globally and converges exponentially locally. This algorithm translates into an enhanced REM scheme and we illustrate the performance improvement through simulation.

We propose an optimization approach to flow control where the objective is to maximize the aggregate source utility over their transmission rates. We view network links and sources as processors of a distributed computation system to solve the dual problem using a gradient projection algorithm. In this system, sources select transmission rates that maximize their own benefits, utility minus bandwidth cost, and network links adjust bandwidth prices to coordinate the sources' decisions. We allow feedback delays to be different, substantial, and time varying, and links and sources to update at different times and with different frequencies. We provide asynchronous distributed algorithms and prove their convergence in a static environment. We present measurements obtained from a preliminary prototype to illustrate the convergence of the algorithm in a slowly time-varying environment. We discuss its fairness property.

Available bit rate (ABR) sources react to network feedback by adjusting their transmission rates. Most schemes fall into one of two types depending on what is fed back and where the control decision is made. Explicit congestion notification schemes allow sources to make control decisions but only with incomplete information on congestion. Explicit rate schemes use more accurate congestion information but make the control decision inside the network without regard to the different desires of various sources. We propose an optimization approach that attempts to combine the advantage of both types of scheme. The objective is to maximize the total utility of all sources over their transmission rates. The dual problem suggests treating network links and ABR sources as processors in a distributed computation system to solve the dual problem using the gradient projection algorithm. In this system ABR sources select transmission rates that maximize their own benefits and network links adjust bandwidth prices to coordinate the sources' decisions. We show how to implement such a system using features defined in the ABR standard. We provide an asynchronous distributed algorithm for links and sources and illustrate their behavior with preliminary simulation results.