A new technique for the DDoS botnet detection based on the botnets network features analysis is proposed. It uses the semi-supervised fuzzy c-means clustering. The proposed approach includes the learning and the detection stages. Analysis is based on the extracted from the network traffic features that may indicate the presence of the DDoS botnets' presence in the network. Experimental results demonstrated that the proposed technique ensures the DDoS botnet detection at the rate at about 95%.
Today one of the most dangerous type of the malware is the botnet - a group of infected
Internet-connected devices with malware and used to control it from a remote location
without the knowledge of the device’s owner. One of the malicious purposes botnets
are used are the spam or DDoS attacks [
In [
In [
In [
The work [
In [
The main drawbacks of the described above approaches are the low rate of the detection efficiency of the DDoS botnets’ detection in the situation of the network employing for the purpose of the attacks performance, when the attack traffic is very much similar to legitimate traffic. 3
During the last years, several attempts to solve the problem of the botnet detection in
the corporate area networks (CAN) were made. Approaches [
A new technique for the DDoS botnet detection based on the botnets network features analysis is proposed. It uses the semi-supervised fuzzy c-means clustering. The proposed approach includes the learning and the detection stages. Let us consider the steps of the learning stage:
1. Knowledge formation based on the features that may indicate DDoS botnet attacks in the network; 2. Presentation of the knowledge about the cyberattacks as a set of feature vectors; The detection stage of the technique consists the following steps: 1. a gathering of the inbound and outbound network traffic; 2. an extraction of the features from the network traffic that may indicate the presence of the DDoS botnets’ presence in the network and building a feature vector; 3. a construction of the feature vectors based on the information obtained from the network traffic;
4. the implementation of the semi-supervised fuzzy c-means clustering of the obtained feature vectors in order to label them to one of the clusters which assigns the specified DDoS botnets attack;
5. a localization of the hosts, infected with DDoS botnets. 4.1
Let us denote the set of attacks, performed by the DDoS botnet as А = {am}mN=A1 , where a1 – the ping flooding attack; a2 – the smurf attack; a3 – the TCP SYN flood attack; a4 – the fragmented UDP flood attack; a5 – the DNS amplification attack; a6 – the TCP reset attack; a7 – the ICMP flood attack; a8 – the SIP INVITE flood attack; a9 – the encrypted SSL DDoS attack; a10 – the ping sweep attack; a11 – the DNS spoofing attack; a12 – the ping of death attack; a13 – the R-U-Dead-Yet DDos attack (R.U.D.Y.), where N A – the number of attacks, performed by DDoS botnets.
Let us denote the set of features, that may indicate DDoS botnet attacks and are to be analyzed as B = {b }NB , where NB – the number of features. The list of features is j j=1 presented in Table 1. Let us denote the set network hosts attacked by the DDoS botnets Feature p fIO pOD bOD dC dEL lp bTC bEH nPSF ps bs oSS ,iSS nDP nNAT nARP fTCP fGEO pR mR sRT
Description transmission protocol a boolean feature that indicates whether the inbound traffic has an associated outbound traffic record a number of packages transmitted from origin to destination a number of bytes transmitted from origin to destination a duration of the connection a duration of the connection, observed from the earliest of the associated inbound or outbound traffic until the end of the latter traffic an average payload length per connection a total number of bytes transmitted per connection a total number of bytes per connection excluding the header a number of a different size of packets transferred to a total number of frames per connection total number of packets in the session total size for the session in bytes dPSB vOBP ,vIBP velocity of outbound/inbound traffic measured in bytes per packet standard deviation of packet size within the session measured in bytes vOBS ,vIBS velocity of outbound/inbound traffic measured in bits per second vOPS ,vIPS velocity of outbound/inbound traffic measured in packets per second as H = {hi}iN=1H , where NH – the number of network hosts. Thus, the function of the DDoS botnet attack identifying f can be presented as: f : hi × bj → am .
self-similarity of the outbound/inbound packets in the session, determined by examining the variance in size of the outbound/inbound packets using the Hurst exponent an amount of denied packets a number of records in the NAT/PAT-table a number of the ARP-requests invalid values of TCP flags seen in this session the geolocation feature defined by IP-address a value of the router’ s processor’ s time, % a size of the router’ s memory used, megabytes server response time, milliseconds 4.2
All the above-mentioned features are the base of the set of feature vectors X = {xk }kN=X1 , where each of feature vector xk describes the botnet’ attack and the legitimate traffic, N X – the number of the feature vectors. Employing the obtained from the network traffic features, which are presented as the feature vectors, the set of rule R is constructed. Each rule describes specified DDoS botnet’ attack. The set of feature vectors forms the training set, which is used for the semi-supervised learning. For instance, the rule R describes the smurf DDoS botnet’ attack can be presented as follows: R : if (((dc > δ)or(dEL > δ′' ))and (dPSB ∈ [ϕ, ϕ′])and ((vOBP < σ)and (vOPS < ο)and (vOBS < κ))and and ((vIBP < ε)and (vIPS < β)and (vIBS < γ))and ((oSS > τ)or(oIS > τ))) ⇒ a13 (1) 4.3
Let c denote the number of the predefined clusters of feature vectors. Each cluster corresponds to the specified DDoS botnets attacks and one cluster corresponds to the legitimate network traffic. The membership of the feature vector xk to the i-th cluster indicates the DDoS botnets attacks performance or its absence in the network.
In order to construct the centroid (the prototype) of the i-th clusters, vi, the labeled
data are to be assumed. It is based on the knowledge about the features that may indicate
the DDoS botnets’ attacks in the network and is presented as the set of feature vectors.
Each feature vector xk of labeled data belongs to one of the predefined clusters. The
semi-supervised fuzzy c-means clustering is based on the minimization of the following
objective function [
i=1 ∑k=1 uipk di2k + α∑ where N – the total number of the feature vectors to be clustered (labeled and unlabeled feature vectors), uik – the membership value for the k-th feature vector in the i th cluster, fik – the membership value of the k-th labelled feature vector in the i-th cluster, dik – the distance between the k-th feature vector and prototype of the i-th cluster, b = [bk ] – a boolean indicator, which distinguishes the labeled and unlabeled feature vectors:
1,if feature vector xk is labeled, bk =
0, otherwise.
The centroid of the i-th cluster, vi, and the partition matrix uik are calculated using the formulas (4) [28]:
vi = ∑kN=∑k1N=u1ui2ki2xkk , uik = 1 +1α 1 + α∑l=c11−ddbilkkk ∑l=c21 fik + αfik bk , (4)
where α denotes a scaling factor to maintain a balance between the supervised and
unsupervised component within the optimization mechanism [
As a distance metric between the k-th feature vector and the centroid of cluster the Mahalanobis distance was used:
dik = xk − vi T A xk − vi , with A being a positive definite matrix in R n × R n . (5) 4.4
At this stage of the method for the purpose of the DDoS botnets’ attacks detection, the monitoring of the network activity, that may indicate its appearance, is performed. The gathered information is sent to the classifier for the further analysis. 4.5
The features that may indicate the presence of the DDoS botnets’ in the network are extracted from data gathered at the previous stage, and are to be analyzed. The result of the analysis is conclusion about the presence or absence of DDoS botnet attack. As the means of the classification is the semi-supervised fuzzy c-means clustering was used. The objects of the clustering are the feature vectors xk , obtained in the analysis of the payload of the inbound and outbound traffic about the possible network hosts' infection. The result of clustering are the membership values uik of the feature vector xk to each cluster i . The membership of feature vector xk to the i-th cluster assigns the type of the DDoS botnets’ attack. 4.6
Based on the membership of the vector of the to malicious traffic the localization of the network host or hosts is carying out. It is performed using the logs with MAC- and IPaddresses of the hosts that carried malicious network requests. 5
In order to determine the efficiency of the proposed technique several experiments were
held. For the experiments the DDoS dataset [
Each experiment lasted 24 hours. Network traffic was captured by means of tcpdump utility. As the training set 15% of feature vectors of the inbound and outbound network traffic were labeled. The experimental results are presented in Table 2 and in Figure 1. The results demonstrated that the efficiency of the DDoS botnets’ detection is at about 95%, while the rate of false positives is about 6%.
Fig. 1. Results of clustering.
A new technique for the DDoS botnet detection based on the botnets network features analysis is proposed. It uses the semi-supervised fuzzy c-means clustering. The proposed approach includes the learning and the detection stages. Analysis is based on the extracted from the network traffic features that may indicate the presence of the DDoS botnets’ presence in the network. Experimental results demonstrated that the detection rate is at about 95% and false positives 6%.