The recent evolution of Internet to new paradigms such as network function virtualization and software de ned networking poses new relevant challenges to the detection of Botnet attacks, calling for innovative approaches. In this work we propose a detection mechanism based on an Arti cial Neural Net classi er trained by available data sets collected in conventional networks. We apply such detection mechanism to the timely use case scenario of a software de ned network infected by the dangerous Botnet Mirai, circulating in October 2016. Experimental results show an accuracy of Botnet detection higher than 99%, thus outperforming available Botnet detection mechanisms currently used in conventional networks.
tra c presented in [
In our work we propose a simpli ed technique which is proved to provide high accuracy in the detection of Botnets in SDNs. The presented results demonstrate that it is possible to detect malicious tra c e ectively by analyzing only the OpenFlow 1.3 messages exchanged by network nodes and the controller. Our approach relies on the tra c classi cation by an arti cial neural network (ANN) to identify Botnets in a SDN as playground. Such ANN is trained with a data training set (TS) obtained by a Botnet attack running in conventional networks (CN), i.e. non SDN. The paper is organized as follows. Sec. 2 introduces the SDN architecture, and methods for choosing the appropriate features to train the ANN for Botnet detection. Sec. 2.3 presents our proposed machine learning technique. Sec. 3 introduces the case study of the Botnet Mirai, emulated on our virtual network, and summarizes the results obtained in the experimentations, showing the performance of our ANN approach in detecting Mirai tra c and discussing its limitations. Finally, conclusions and possible future work are presented in Sec. 4. 2 2.1
The proposed approach relies on the passive monitoring of network tra c in SDNs, resulting in a more lightweight approach than Deep Packet Inspection (DPI) methods. The schematic of the system architecture is shown in the principle diagram in Fig. 1.
A SDN allows a single controller to orchestrate an entire network of switches. The SDN architecture is split in three layers: the lowest layer (Data Layer ) is composed by hardware and virtual switches and is interfaced to the upper layer (Control Layer ) by the Southbound APIs; the Control Layer (indicated as SDN Controller in Fig. 1) de nes the entire network performance by monitoring and con guring the network entities; the top layer is the Application Layer, interfaced to the controller by the Northbound APIs, that allows di erent applications to be developed on top of the control layer, including relevant network functionalities such as network management, security, middlebox and so on.
The communications between the switches in the data plane and the controller are regulated by the OpenFlow protocol, which provides the rules and the formats of messages (Southbound API). An OpenFlow-compatible forwarding device in data plane consists of three parts: i) a ow table that stores the action(s) to be applied to process the ow(s), one entry per each ow; ii) a secure channel for the message exchange with the controller; iii) the OpenFlow protocol.
An entry in the ow table has ve elds, as shown in Fig. 2: i) the match, with information about the packet header that de nes the ow; ii) the action, which de nes how the packets should be handled; iii) the counter, which keeps track of the amount of packets per ow; iv) the priority, which de nes the order to process the rule, convenient to get statistics e ciently; v) the time-out, where the idle timeout and hard timeout control establishes the removal time of a ow entry from the OpenFlow table.
The components of the Botnet Detection technique proposed in this paper are shown in Fig. 1 and reside in an application running on top of the SDN controller, which uses the Northbound RESTful APIs to interact with the controller.
The Attack Prevention Module (APM) in Fig. 1 is responsible of creating an appropriate rule in the eld action of the Flow Table (see the Fig. 2) of the virtual switches whenever a ow is detected by the Bot Detection Engine to be malicious and involved in a Botnet attack. Such rule blocks the infected host that is identi ed by its mac address. The installation phase of the blocking rule for a ow considered malicious proceeds in two steps: i) the mac-address of the infected host is recovered from the ow ID; ii) the APM communicates to the controller, through the Northbound API, that the drop rule has to be installed in the ow entry corresponding to the involved virtual switch in the detected malicious tra c. The Bot Detection Engine uses a Machine Learning (ML) technique to classify the tra c. In ML a system acquires knowledge through experience and is able to distinguish the speci c patterns or anomalies for which it has been trained. This one is speci cally trained to detect the presence of one or more components of a botnet in the network. The detection is typically based on the evaluation of appropriate discriminators, referred to as features in the ML eld, which are application-speci c. In the following, we describe the most common discriminators used for conventional data networks and SDNs, which are the ones we used in our experiments. 2.2
The discriminator lter extracts a set of relevant parameters, referred to as discriminators, that are appropriately processed and given as input features to the ANN, core of the BotNet Detection Engine.
We selected a set of relevant features according to the de nition of bidirectional ow within the use
of time windows [
Feature First packet size (Bytes) Number of small packets, i.e. with size lower than 320 Bytes, in the time window Number of packets Average payload size, i.e. the ratio between the size and the number of payloads in the time window Data Rate, i.e. the ratio between the number of bytes exchanged within the time window and the time window size Variance of payloads size in the time window Ratio between in-packets and out-packets Relevance It reveals typical characteristics of network protocol and refers to the entire ow Its use is widely known in P2P Botnet and in Bot { C&C server communications Some Botnets try to keep the connection open by sending a large number of packets in a speci c time window Typically, in legitimate tra c ow this value is higher than the one of the Botnet tra c ow Typically, normal tra c generates higher values Useful for nding DoS attacks or to detect evasion techniques employed in communication between Bots and C&C consisting in sending fake packets Bots are not managed by humans and are programmed to respond to a set of commands they receive.
In order to gain some insights about the complexity of the learning problem, we tried at rst to determine the minimum number of hidden neurons in a MLP with a single hidden layer that achieved an acceptable error rate. This preliminary study is particularly important for the Botnet detection task, as a large number of neurons in the MLP results in longer computation time that may negatively a ect the real-time performance of the desired detection engine. We found out that just 5 hidden sigmoid neurons were su cient to achieve an acceptable error with a small improvement by using a higher number of hidden neurons. Consequently we tried to increase the number of hidden layers, just to discover a small improvement in the performance of the Botnet detection.
Details about training and evaluating the MLPs are given in the following section 2.4.
Our Botnet detection engine is developed as an external software kbDetector that communicates
via Northbound-API with the OpenDayLight controller, in order to capture statistical information
about tra c with the OpenFlow protocol and turns it into input features to be given to the MLP. Our
strategy di ers from the typical intrusion detection schemes designed for SDN running on the controller
[
Moreover we developed the application kbTool that manages host blocked by kbDetector. kbTool communicates via REST API with the controller in order to share con guration les with kbDetector.
We performed some experiments for some selected MLP architectures that are reported in Fig. 3 for both CNs and SDNs. All the MLP architectures were tested with di erent sizes of the timewindow. The main result we obtained is that an MLP trained over data concerning non-SDNs has a very satisfactory performance also when tested for Botnet detection in SDNs. As expected, though, the test error in SDNs is higher than that for non-SDNs that they were trained for. We can then note that longer time windows bring about a better test error for most architectures, and that a four layers MLP is good enough to achieve an error rate of less than about 0.05%. 2.4
For our experiments, we compute features based on portions of packet tra c until the layer 4 (ISO/OSI stack), thus the ows have the same characteristics in SDNs and CNs, and are completely transparent to an observer. The di erence is in the speci c set of discriminators used to train the ANN in the two cases of CNs and SDNs, as explained in Sec. 2.2.
The MLPs in the experimentation were trained over a TS obtained by joining public datasets that
are commonly used in the literature for Botnet malicious tra c identi cation. The rst is the CTU-13
dataset [
Due to the large size of these two datasets, we considered appropriate a subdivision into small pcap les performed via the opensource tool SplitCap 3 in order to create a division of ows.
The ISOT dataset dimension is 9.9 GB and contains 914812 di erent ows.
Di erent training sets and test sets of discriminators are created by applying the software pcap2ml
we developed on purpose and using the following time windows: 10, 30, 60, 120, 180, 240, and 300
seconds. This choice allows a quick comparison with other studies [
MLPs training was stopped either when the error was considered acceptable (0%) or when a maximun number of 1500 training epochs was reached. The synaptic plasticity of the hidden sigmoid neurons was xed to 0.3 and the momentum term to 0.1. Performance of the trained MLPs is measured by means of the confusion matrix with its four quadrants that represent true positive TP, false positives FP, true negatives TN and false negatives FN, where obviously the actual positives result in total P = TP+FN and the negatives N = TN+FP. The confusion matrix metrics resulting from our experiments are presented in Fig. 5 for the selected ANN's architecture (7 11 5 1)5. The performance metrics for a supervised NN are computed from the four quadrants of the confusion matrix: the model accuracy is de ned as A=(TP+TN)/(P+N), its precision as S=TP/(TP+FP), and the recall as Re=TP/P=TP/(TP+FN). The values of these performance metrics obtained in our tests are shown vs. the time window's duration in Fig. 6 for both CNs and SDNs with protocol OpenFlow 1.3, for the selected ANN architecture.
3Splitcap: www.netresec.com/?page= SplitCap 4https://stratosphereips.org/category/dataset.html project 5We made experiments for all architectures and obtained almost identical confusion matrices. Since we selected the architecture 7-11-5-1 as the one that gives the minimum errors (Ref. to Fig. 3), to simplify the Fig. 5 we reported only the confusion matrix associated with this architecture.
We may notice that, as a general trend, the precision appears independent from the duration of the time window in both cases of CNs and SDNs, showing a very slight decrease for larger time window. The accuracy and the recall, instead, grow with the increasing time window in all cases. Furthermore, comparing the two types of networks, the accuracy and the recall are higher in CNs than in SDNs. 3
The experience of the last October, when Mirai Botnet DDoSed 17 Dyn Data Centers (DCs),
represents a case study from which we have to learn. Today DC networks manage high volumes of dynamic
tra c and there is no doubt that the most dangerous threat for the performance of a DC is represented
by a DDoS attack. Hence, as a test case for our experiments we consider a DC network. The spread
of the malware on Internet has been strongly boosted by the online availability of the code for Mirai,
which was posted by a hacker known as Anna-Senpai 6, then many cyber criminals started using the
tool to assemble their own botnet armies. We simulate the same event in a SDN environment, by
implementing a typical Fat-tree topology to create a Software-De ned Data Center (SDDC) with 4
pods within the Mininet framework [
Average of Bytes 68.473 68.363 67.333 num. of Bytes 3903.0 2256.0 606.0
Arrival rate 0.0316 0.183 0.05
Byte/time 21.68 12.53 3.366
Our experimentation relies on the evaluation of the tra c ows in the network in order to generate the set of relevant features to be given in input to the ANN for the Botnet detection and evaluate the performance of our approach in terms of confusion matrix metrics accuracy, recall and precision for Mirai detection. A sample of tra c between C&C and bots detected in a time window of 180 seconds is shown in Table 3. In particular, the packet set (in both directions) is represented by a quintuple consisting of source address, destination address, source port, destination port, and protocol at the transport level. We analyse the e ciency of the trained ANN as a Botnet detection tool by simulating UDP ood attacks by bots replicated from the Mirai malware. We obtained the best performance in the attack detection for time windows of large duration, as expected, and for time windows of 240 or 300 seconds the performance is roughly the same. In practical implementations, the only possible time window with the current version 1.3 of OpenFlow protocol is 300 seconds. However, a real-time system for botnet detection would bene t signi cantly from the use of time-window sizes of few seconds, especially if measures, like, e.g., isolation from the rest of the network, should be taken. The main reason is that the current protocol is not provided with a method for extracting ow statistics at arbitrary time intervals, and the only way is by removing a ow entry from the switch. Furthermore, in a high tra c environment, such as DCs, that manage a large number of streams, it is mandatory to reduce the number of rule removals per second. So, there is no choice but setting the time window at the highest possible duration. 4
In this paper we have shown that the statistical analysis and classi cation by a supervised neural network is an e ective method for detecting the malicious tra c produced from bots during the attacks, for individuating the communication ow between bots and C&C and for preventing the attacks. In addition, we have shown that it is possible to block the attacks at the source, not simply a mitigation strategy. During the testing phase we noticed, like a serendipity, that DDoS attacks were automatically recognized by our neural network despite the work is explicitly focused on Botnet detection and not on the e ects of their application. In particular, the use of neural networks has been as e ective as other Machine Learning methods with 99% accuracy. The use of the OpenFlow protocol version 1.3 imposes some limits, like e.g., the impossibility of performing real-time detection, due to the constrained time window duration. It is expected that the OpenFLow 1.5.1 protocol, which is not implemented yet in ODL and in some switches open-source, will allow a more exible customisation of the type of statistics that can be extracted from a stream. Future re nements of the proposed work include the analysis of performance of the detection application by implementing the kbDetector with Big-Data techniques and the implementation of a malicious tra c generator to improve the neural network training.