Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
413
While our prototype implementation does not cover all aspects of our approach
yet and some issues remain open for further research, we were able to verify
that the suggested features were affected by the Miner botnet client in the predicted
manner. Single measurements will however not provide the level of certainty traditional
payload signatures can provide for today’s botnets. Thus, detection has to
be carried out as an iterative process, taking into account a series of measurements
for each observed system. Similar problems have been studied in the field
of sensor data fusion and thus our current and future research is part of a joint
effort to migrate the methods and algorithms developed in that field into network
intrusion detection.
Acknowledgment
We would like to thank our colleagues at the FKIE Cyber Defense and Sensor
Data and Information Fusion departments, the University of Bonn Computer Science
Department 4 and the Singapore DSO National Laboratories for our fruitful
discussions and their advice. Our special thanks go to Daniel Plohmann of FKIE
Cyber Defense for providing a reverse engineered implementation of the Miner C 2
protocol and his support in setting up our evaluation environment.
References
[1] D. Plohmann, E. Gerhards-Padilla, and F. Leder, “Botnets: Measurement, detection,
disinfection and defence.” Technical Report published by the European Network and
Information Security Agency (ENISA). Editor: Giles Hogben, 2011.
[2] N. Falliere, L.O. Murchu, and E. Chien, “W.32 Stuxnet dossier,” Technical Report
published by Symantec, 2011.
[3] V. Paxson, “Bro: A system for detecting network intruders in real-time,” in Proceedings
of the 7 th USENIX Security Symposium, 1998.
[4] “Snort Official Website.” Available: www.snort.org
[5] K. Rieck, G. Schwenk, T. Limmer, T. Holz, and P. Laskov, “Botzilla: Detecting
the ‘phoning home’ of malicious software,” in Proceedings of the 2010 ACM Symposium
on Applied Computing, 2012.
[6] G. Gu, R. Perdisci, J. Zhang, and W. Lee, “BotMiner: Clustering analysis of network
traffic for protocol- and structure-independent botnet detection,” in Proceedings
of the 17 th USENIX Security Symposium, 2008.
[7] M. Celenk, T. Conley, J. Willis, and J. Graham, “Predictive network anomaly
detection and visualization,” in IEEE Transactions on Information Forensics and
Security, vol. 5, no. 2, 2010.
[8] T. Karagiannis, K. Papagiannaki, and M. Faloutsos, “BLINC: Multilevel traffic
classification in the dark,” in Proceedings of the 2005 ACM Conference on Applications,
Technologies, Architectures, and Protocols for Computer Communications, 2005.