Unsupervised Hadoop-based P2P Botnet Detection with Threshold Setting

During the last decade most of coordinated security breaches are performed by the means of botnets, which is a large overlay network of compromised computers being controlled by remote botmaster. Due to high volumes of traffic to be analyzed, the challenge is posed by managing tradeoff between system scalability and accuracy. We propose a novel Hadoop-based P2P botnet detection method solving the problem of scalability and having high accuracy. Moreover, our approach is characterized not to require labeled data and applicable to encrypted traffic too. * {khalid.huseynov, kkj}@kaist.ac. kr * This research was funded by the MSIP (Ministry of Science, ICT & Future Planning), Korea in the ICT R&D Program 2014 [1391104001, Research on Communication Technology using Bio-inspired Algorithm] *. This research was supported by the KUSTAR-KAIST Institute, KAIST, Korea. paradigm in spamming botnet detection. BotCloud [11] is another detection method utilizing large graph processing capabilities of Hadoop. They have adapted the PageRank algorithm in the context of botnet detection and correlated the page rank of node with its probability of being bot. III.Detection technique and methodology 3.1 Approach overview The overview of the system architecture is shown in Fig.1. The Module 1 is used to parse pcap files in parallel in the HDFS. This library is adopted from the work of Lee et al. [13]. Fig. 1. Overview of the system architecture. 3.2 P2P host detection and implementation The main purpose of Module 2 in Fig. 1 is to detect hosts with any kind of P2P activity. In order to differentiate P2P applications from normal user behavior (e.g. browsing, file downloads), we consider a number of features listed below. Failed Connections. Normally, P2P applications expose higher number of failed connections due to the peer churn [14] phenomenon. We consider as failed any TCP or UDP flow with outgoing packet but no response packet, and a TCP flow with a reset packet. Unresolved connections. DNS utilization behavior of P2P applications is different from the one of normal traffic [15]. Hosts running P2P applications resolve the IP list from the peers as opposed to DNS query. Thus we consider the number of DNS queries (answers) sent (received) as well as whether the flow have been previously resolved from DNS answer. Destination subnet diversity. Another distinction of P2P traffic from normal Internet traffic is the diversity of destination hosts. Usually those hosts are scattered around numerous subnets separated geographically. Thus, we extracted the following two features: number of distinct IPs contacted by the host, and the number of different /16 prefix subnets connected by the host. Fig. 2 represents detailed design of Module 2 (P2P host detection) in Hadoop framework. Fig.2 Design of Module 2 in Hadoop framework. 3.3 Fine-grained P2P botnet detection and implementation Only traffic from the hosts running P2P applications is passed further to Module 3 in Fig. 1. The duty of Module 3 is to differentiate between hosts running legal P2P applications (e.g. Skype. eMule) and botnet infected ones. Here we utilize the following observations. First of all, we use the observation that P2P botnets have persistent flows compared to normal P2P applications [14]. Second observation is that the set of hosts connected by bots have more common hosts compared to legal P2P application. ISOT dataset created by Information Security and Object Technology (ISOT) research lab at the University of Victoria was used for the benchmark [16]. Additionally we used a dataset consisting of legal P2P applications from the research group at Georgia Tech [9]. IV. Results and Discussion Table 1 shows the detection results for Modules 2, and 3 of the detection system. Table 1. Detection results Type of P2P host Module 2 (#detected/#total) Module 3 (#botnet/ #P2P host ) Skype 6/7 1/6