On botnet behaviour analysis using GP and C4.5
Fariba Haddadi, Dylan Runkel, Nur Zincir-Heywood, Malcolm Iain Heywood · 2014
Botnets represent a destructive cyber security threat that aim to hide their malicious activities within legitimate Internet traffic. Part of what makes botnets so affective is that they often upgrade themselves over time, hence reacting to improved detection mechanisms. In addition, Internet common communication protocols (i.e. HTTP) are used for the purposes of constructing subversive communication channels. This work employs machine learning algorithms (genetic programming and decision trees) to detect distinct behaviours in various botnets. That is to say, botnets mimic legitimate HTTP traffic while actually serving botnet purposes. To this end, two different feature sets are employed and analyzed to see how differences between three botnets - Zeus, Conficker and Torpig - can be distinguished. Specific recommendations are then made regarding the utility of different feature sets and machine learning algorithms for detecting each type of botnet.