Military Communications and Information Technology: A Trusted ...

408 Military Communications and Information Technology...
the measurements for our features concerning legitimate servers. To distinguish
between servers and clients, we can also exploit their sinkhole structure in terms
of the network flow direction.
C. Infected
The malicious behaviour of an infected host can possibly only be observed
in interference with benign user actions. However, we assume that the malware
activities have a significant impact on the features described above. As the malicious
activities are machine-controlled, they might be assumed to occur in timely
regular patterns [20]. This implies needle-like bandwiths in the frequency domain.
Again, the same holds for the flow volume. This is due to the fact that the number
of possible actions of a malware is very limited [19].
VIII. First results
In the preceding sections, we described the foundations for a system that distinguishes
between regular client or server systems and systems that have been infected
with a botnet client. Our prototype implementation does not cover all of these concepts
yet but provides a base for estimating whether our assumptions were correct.
The Waikato traces briefly described in section VIII.A provide our baseline for
network traffic predominantly generated by benign systems. In the section thereafter
we describe our method for obtaining a network trace from a live botnet client by
executing it in a secure environment. Finally, we discuss the feature distributions
observed for these traces in section VIII.C.
A. Waikato
We use network traces provided by the Waikato Internet Traffic Storage
(WITS) of the University of Waikato, New Zealand as a baseline for “normal” traffic.
The traces were captured at the university’s Internet exchange, between June
and September 2007. They do not include layer 4 payloads and IP addresses have
been anonymised by XOR’ing them with a key which would be changed once every
week. Please refer to the WITS website [21] for additional details on the trace files.
Since considering the whole dataset would be unlikely to provide any insight
beyond that provided by a well-chosen sample, we selected two trace files from
consecutive weekdays, the 4th and 5th of September 2007 for this evaluation. We
could not use traces from different weeks since the anonymisation may result
in systems with different roles being mapped to the same address, possibly distorting
measurements.
Also, anonymisation prevents the use of legacy methods for detecting malicious
traffic. Thus, we cannot ensure that the traffic observed in these traces does