An efficient method to detect periodic behavior in botnet traffic by analyzing control plane traffic.

Area of Science:

• Computer Science
• Cybersecurity
• Network Security

Background:

• Botnets, networks of compromised machines, pose significant threats to internet communications.
• Botnet command and control (C2) traffic is crucial for attack execution and coordination.
• Detecting C2 traffic early can prevent botnet-induced harm.

Purpose of the Study:

• To identify and exploit the periodic behavior of botnet C2 traffic for detection.
• To develop a scalable method for botnet C2 traffic detection.
• To evaluate the effectiveness of the proposed detection method against different botnet types and background traffic.

Main Methods:

• Analysis of C2 traffic for periodic behavior.
• Utilizing periodogram analysis to evaluate traffic patterns.
• Applying Walker's large sample test to identify periodic components in traffic data.
• Testing the method on SLINGbot-generated tinyP2P and IRC botnets and real enterprise network traffic.

Main Results:

• Botnet C2 traffic exhibits a discernible periodic behavior.
• The proposed spectral analysis method successfully detects periodic C2 traffic.
• The detection method is scalable, avoiding deep packet inspection.
• The test's performance was evaluated under various conditions, including background HTTP traffic.

Conclusions:

• The periodic nature of botnet C2 traffic can be reliably detected using spectral analysis and statistical testing.
• This approach offers a scalable and effective solution for botnet detection.
• The findings contribute to enhancing network security by enabling early identification of botnet activities.