A Malware Beacon of Botnet by Local Periodic Communication Behavior

Botnets are one of most serious threats in cyber security. Many previous studies have been proposed for botnet detection. Among those approaches, one of main tracks focuses on extracting informative features from network traffic flows. Nevertheless, most features of interest are extracted from the information of a single connection, such as flow duration, flow packet size etc. In this paper, we proposed an novel feature, which is able to detect a long-term behavior of botnets. More specifically, we aim to extract a malware beacon from the periodic communication between bots and bot master. Besides the regular communication pattern, we also explore several types of botnet behavior to leverage the effectiveness of the proposed feature. Our experimental results show that our proposed periodic communication signature could be one of effective features for detecting compromised devices.

I. Introduction

A botnet is a network of compromised computers (or bots) which are controlled by the intruder (or bot master) [1], [2]. The bot master communicates and controls the bots by command and control (C&C) channels. That is, the bots will be connected to the C&C server to get the instructions from the bot master, and change their behavior according to those instructions as shown in Fig. 1. Botnets have become one of most serious threats in cyber security [3] since the bot master can trigger a powerful cyber-attack to a victim by manipulating huge amounts of bots. Those cyber-attacks include distributed denial-of-service (DDOS), identification theft, spamming etc. With the tremendous attack power, botnets not only used for acquiring economic profits but also to take advantage from organizations or governments.