Autonomous Botnet Detection

Abstract

With the pervasiveness of internet, huge threats have been seen in last few decades. These threats involve the activities for violation of security in terms of integrity, confidentiality, denial of service, authentication. Due to the existence of such threats, there is requirement to defend our immense corporate secret, online banking account details and social networking account accessible via web interface. Over last few decades there is the emergence of botnet within internet. Botnet can be considered as the mass of compromise machine that are under the authority and control of single botmaster. Because of existence of such botnet there arouse intrusion. And hence intrusion detection has turn out to be sphere of influence of information assurance. At the network-level, the research work to detect bots has proceeded along two important area of vertical and horizontal correlation engine. Vertical and local correlation engine have the downside that these systems require prior knowledge about communication channel and it is indispensable to have at least two hosts in the monitored network(s) should be the members of the same botnet. Hence the new autonomous model is proposed by combining the concept of observation of command and responses received. This model will be built in controlled environment with recording of network activity by using subspace and evidence accumulation clustering. Proposed models are helpful for detection of bots in the midst of few false positives.

Keywords: : Intrusion; intrusion detection system; botnet; threat; evidence accumulation; subspace clustering