# Abnormal Behavior Detection to Identify Infected Systems Using theAPChain Algorithm and Behavioral Profiling

Authors: Jungwoo Seo; Sangjin Lee
Journal: Security and Communication Networks
 (2018)

---

## Abstract

Recent cyber-attacks have used unknown malicious code or advanced attack techniques, such as zero-day attacks, making them extremely difficult to detect using traditional intrusion detection systems. Botnet attacks, for example, are a very sophisticated type of cyber-security threat. Malicious code or vulnerabilities are used to infect endpoints. Systems infected with this malicious code connect a communications channel to a command and control (C&C) server and receive commands to perform attacks on target servers. To effectively protect a corporate network’s resources against such threats, we must be able to detect infected systems before an attack occurs. In this paper, an attack pattern chain algorithm (APChain) is proposed to identify infected systems in real-time network environments, and a methodology for detecting abnormal behavior through network-based behavioral profiling is explained.APChain analyzes the attribute information of real-time network traffic, connects chains over time, and conducts behavioral profiling of different attack types to detect abnormal behavior. The dataset used in the experiment employed real-time traffic accumulated over a period of six months, and the proposed algorithm was developed into a prototype for the experiment. The C&C channel detection accuracy was measured at 0.996, the true positive rate at 1.0, and the false positive rate at 0.003. This study proposes a methodology that can overcome the limitations of conventional security mechanisms and suggests an approach to the detection of abnormal behavior in a real-time network environment.


---

## Body

## 1. Introduction

According to the 2016 Internet Security Report [1], targeted attacks, such as spear phishing, increased by 55% in 2015 compared to the previous year. Notably, in 2015, attacks using zero-day vulnerabilities increased by 125%. Every year, more than 10 new zero-day vulnerabilities are reported. Moreover, 430 million new pieces of malicious code were discovered in 2015, a 36% increase from the year before. New vulnerabilities include targeted attacks, smartphone threats, social media scams, and Internet of Things (IoT) vulnerabilities.In the past, attacks tended to extensively infect nonspecific systems with malicious code; however, cyber-attacks that attack targets with specific objectives, such as leaking important information or destroying the system, are becoming more common [2]. Attackers distributing malicious code can control a remote host through a command and control (C&C) channel and connect to backdoor networks to perform its attacks. An effective way to detect hosts that are infected by a botnet is to detect the C&C channel and eliminate the infected system before the attack can be launched. However, a number of major challenges exist in detecting C&C channels. For example, attackers may regularly change the address of the C&C server or use evasive methods such as proxy server traffic redirection. Additionally, because C&C channels use HTTP or HTTPS protocols to communicate, they are difficult to distinguish from general web traffic, making it challenging to establish a definitive countermeasure.The research in [3, 4] identified botnet C&C channels in an internal network without any prior information. However, as mentioned in [5], because botnet attacks have distinguishable characteristics, an improved detection algorithm is needed [6]. For example, the research in [3] detected C&C channels by checking the active responses from a host group at regular time intervals. However, to communicate with the C&C server, a botnet attempts to make contact in irregular connection cycles, presenting a problem for existing methodologies employed to detect C&C channels. For that reason, recent studies, including [4, 7–9], have switched their focus to detecting abnormal behaviors of infected systems.The effective detection of a botnet requires a detailed understanding of the internal network environment and the information service, as well as the configuration of multiple network monitoring environments such as log analysis, file integrity checking, registry monitoring, and rootkit detection. However, when configuring a host-based and network-based consolidated monitoring environment in a corporate network environment, resource utilization and performance limitations are typically encountered. Setting up many rule sets and excessive anomaly detection protocols to identify botnets in a large volume network environment will increase resource inefficiency and, in some cases, threaten the operability of the internal network. Because of these problems, companies limit the rule sets for their information security system or shut down their detection function. Therefore, understanding the characteristics of a botnet, improving resource efficiency, and providing stable detection performance are important elements of any response to intrusions.In this paper, in order to detect botnets, the attribute information of network traffic is used to construct an attack pattern chain algorithm (APChain) over time, and behavioral profiling is conducted to detect abnormal activity. With this method, real-time network traffic analysis, optimal resource utilization, and encrypted packet attack detection are possible.The remainder of the paper is structured as follows. Section2 reviews related work and current challenges, while Section 3 presents a conceptual overview of the proposed approach. Section 4 describes the system model for the proposed algorithm’s architecture. Section 5 presents an experimental evaluation of the approach using a real-time traffic dataset. Finally, conclusions are drawn in Section 6.


## 2. Related Work

Botnets have become a major threat on the Internet and extensive research has been conducted over the past several years to detect them. Botnet detection can be classified into two main types: vertical correlation [10] and horizontal correlation [3, 11].BotHunter [10] is an example of detection based on vertical correlation. It observes a single machine and compares its behavior with a model of bot behavior. It recognizes correlated dialog trails consisting of multiple stages and representing successful bot infection. Therefore, this strategy is also referred to as “dialog correlation.” BotHunter is designed to track two-way communication flows between internal assets and external entities and consists of a correlation engine driven by several malware-focused network detection sensors. The BotHunter correlator links the dialog trail of inbound intrusion alarms with those outbound communication patterns to detect infected local hosts. When a sequence of evidence matches BotHunter's infection dialog model, a report is produced that captures all of the events relevant to the local host’s role in the infection process.BotHunter has some important limitations. For example, it is restricted to the life cycle of the predefined infection model, and some stages, such as C&C communication, provide only signature-based sensors. Thus, BotSniffer and BotMiner are often used to complement BotHunter. They do not necessarily require the observation of multiple different stages within an individual host, nor do they require botnet-specific signatures.BotSniffer [3] and BotMiner [11] operate on the principle of horizontal correlation by observing correlations and similarity across multiple hosts. Because horizontal correlation detection strategies conduct preprogrammed activities related to the C&C channel under the control of a botmaster, bots within the same botnet will exhibit spatial-temporal correlation and similarity. BotSniffer is designed to primarily detect centralized C&C channels, and it monitors multiple rounds of spatial-temporal correlation and the similarity in activity responses from a group of hosts that share a common centralized server connection such as IRC or HTTP. BotSniffer can achieve the theoretical bounds for false positive and false negative rates within a reasonable detection time using statistical algorithms. BotMiner presents a more general detection framework that is independent of botnet C&C protocols and structure. It clusters together similar communication traffic and similar malicious traffic and performs cross-cluster correlation to identify hosts that share similar communication and malicious activity patterns. Therefore, these hosts are considered bots within the monitored network. BotSniffer has an important limitation in that it is restricted to the detection of botnets that primarily use centralized C&C channels. With horizontal correlation, it is difficult to detect a botnet in a small network environment and to classify hosts that are infected with different characteristics of the botnet within the same network range. In addition, BotHunter, BotSniffer, and BotMiner all usually require a relatively long time to observe multiple stages of botnet communication.Other strategies for botnet detection have also been proposed. In [12], specific traffic information is extracted to run a learning module that can detect a C&C channel. NetFlow’s records (flow size, client access patterns, and temporal behavior) are used to identify the characteristics of the traffic; using the learning module, reference values are created to match the C&C channel characteristics. A detection module then conducts matching to detect the botnet C&C channel. In [13], attacks are detected by analyzing ordinary HTTP requests and C&C channel characteristics to detect HTTP-based C&C channels. To precisely differentiate between C&C and legal domains, a CODDs-defined approach is proposed. The proposed algorithm analyzes the DNS information requests corresponding to these domains during a particular time window.In this paper, theAPChain algorithm is proposed to detect abnormal behavior. Abnormal behavior traffic is detected in the initial stages with the goal of quickly eliminating systems infected by malware. We configure port mirroring on the backbone switch to createAPChain in a real-time network. Over a period of time, attribute information is linked to the chain, and the results fromAPChain are then used to conduct behavioral profiling to detect abnormal behavior.This study makes three main contributions. First, this paper proposes an approach that differs from traditional methods of botnet detection. The proposed methodology constructsAPChain using traffic attribute information and detects abnormal behavior such as botnets through behavioral profiling. Our system is able to detect new types of botnet and can improve its accuracy by modifying its behavioral profiling algorithm. Second, botnets can have very flexible C&C channels. They can use different protocols such as IRC and HTTP and can encrypt content for C&C communication [3, 10, 11, 14]. This paper proposes a detection scheme that groups hosts with similar behavior over time. We are able to determine the IP address of the C&C server, the connection time, and connection count, among other parameters. As a result, the proposed approach detects variable C&C channels by tracking communication with the C&C server. Finally, current detection techniques are based on the inspection of network traffic. However, recent malware uses encrypted C&C traffic or code obfuscation to evade these detection techniques. The proposed methodology utilizes the attribute information of the protocol header to overcome problems associated with analyzing the payload of network traffic. Therefore, it is possible to detect encrypted C&C channels and to detect the abnormal behavior of obfuscated packets.


## 3. System Overview

In this section, we investigate the overall concept of the proposed methodology, the configuration ofAPChain in detecting abnormal behavior, and the behavioral profiling process.


### 3.1. Overview of the Proposed Methodology

Recent cyber-attacks are initiated by using advanced social engineering or by sending a targeted e-mail to attack targets [15]. If a host is infected by malicious code, an attempt to communicate with a C&C server is made and a communications channel is formed using Internet Remote Chat (IRC) or an HTTP protocol. When a communications channel is established, the host receives an attack command from the C&C server or updates the binary file. At this time,APChain is configured to monitor real-time traffic and detect abnormal behavior, followed by behavioral profiling.The methodology proposed in this paper is presented in Figure1. It consists of a five-step process to detect abnormal behavior. First, real-time traffic is collected by the flow collector and attribute information from the collected traffic is extracted. Second, this traffic attribute information is analyzed in order to configureAPChain.APChain’s role is to connect the features of the traffic attribute information into a chain and to match this to abnormal behavior. Third, behavioral profiling based onAPChain is conducted. Fourth, suspicious patterns are categorized and abnormal behavior is detected. Finally, intrusion responses against the abnormal behavior are executed, and network forensics for an audit trail are conducted.Figure 1
Conceptual diagram of the proposed methodology.


### 3.2. Attack Pattern Chain Algorithm (APChain)

In order to detect abnormal behavior, attribute information is extracted from the DMZ or the internal backbone switch, and a chain is configured that contains the attribute information over time.


#### 3.2.1. Attribute Information forAPChain

Network traffic headers contain a variety of information such as the IP addresses and protocols of the origin and destination. The standardized extraction defined by the communication protocol enables efficient analysis. An 8-tuplesource IP, source port, destination IP, destination port, protocol, access time, MAC, URL, which contains the fundamental attribute information required to createAPChain, is extracted from the traffic header and payload, and a 10-tuple SN,SGN,TIN,CND,RATD,CNTI,RATD,CNTI,ACTTI,SCTTI is created, which provides additional attribute information based on the extracted 8-tuple. The 8-tuple defines the network connection between the origin and the destination systems, and the 10-tuple is utilized as analysis data for the detection of a host’s abnormal behavior.


#### 3.2.2. Execution Results ofAPChain

The 8-tuplesource IP, source port, destination IP, destination port, protocol, time, MAC, URL, collected through the network switch of the experimental environment depicted in Figure 10, is used as input to createAPChain. The results using theAPChain algorithm in Table 3 are expressed as Output=Input ∪SN,SGN,TIN,CND,RATD,CNTI,RATD,CNTI,ACTTI,SCTTI. Table 1 presents theAPChain table created using the traffic attribute information.Table 1
APChain table.
Attribute Type Description SN Varchar Sequence number  SGN Varchar Sequence group number with the same destination IP  Sip Varchar Source IP  Sport Integer Source port  Dip Varchar Destination IP  Dport Integer Destination port  MAC Varchar Media Access Control address  PT Varchar Protocol  TS Date Time stamp  URL Varchar Uniform Resource Locator address  TIN Integer TIN subtracts the previous access time from the current access time  CND Integer CND is the cumulative number of times a connection is made to the same target IP address  RATD Integer RATD is the connection time interval to the same target IP address  CNTI Integer CNTI is the cumulative number of times a connection is made to the same target IP address over 30 minutes  ACTTI Integer ACTTI is the average connection time interval to the same target IP address over 30 minutes  SCTTI Integer SCTTI is the standard deviation of the connection time interval to the same target IP address over 30 minutesFigure2 shows an example ofAPChain configuration for the abnormal traffic behavior of a host infected by malicious code.Figure 2
Conceptual diagram ofAPChain configuration.For example, the intrusion server (217.11.xxx.78) connects to the malicious server (12.5.xxx.48), which distributes malicious code, infecting the host. The infected host periodically communicates with the C&C server (106.23.xxx.129) and updates the binary malicious code or receives an attack command. At this time, to configureAPChain to detect abnormal behavior, port mirroring is configured on the backbone switch, and network traffic attribute information is extracted to createAPChain. This traffic attribute information is utilized to calculate additional attributes and added toAPChain.When connections are made to a web server with the same target address, they are defined inAPChain by the same group name, “GXXX53-PXXXX,” and, after they are interconnected in the chain, behavioral profiling is conducted to detect abnormal behavior.


### 3.3. Behavioral Profiling

Behavioral profiling analyzes attack types based on their characteristics and categorizes any traffic that exhibits abnormal behavior. Table2 shows the behavioral profiling algorithm usingAPChain.Table 2
Behavioral profiling algorithm.
Algorithm 1. Behavioral Profiling  Input: Result of Function APChain (T): where T is a collection of network traffic. Output: Results of abnormal behavior Function Behavioral_Profiling (T): H = h 1 ,  ⋯ , h n ,  h m, where h is the host infected by malware D = d 1 ,  ⋯ , d n , d m, where d represents destination servers R ⟵ RATD field value of APChain C ⟵ CNTI field value of APChain A ⟵ ACTTI field value of APChain S ⟵ SCTTI field value of APChain while(not stop condition)do ifAbnormal_Behavior C&Cthen M = m 1 ,  ⋯ , m n ,  m m, where m is the C&C server /∗the host attempts to connect to the C&C server∗/ i n t e r v a l H → M ∈ ( A ± S ) f r e q u e n c y ( H → M ) > C ifAbnormal_Behavior (Pharming)then M = { m 1 ,  ⋯ , m n ,  m m }, where m is the fake website /∗the host connects to the fake website∗/ i n t e r v a l ( H → M ) < θ i f r e q u e n c y ( H → M ) > θ j ( d n . D i p = d m . D i p )  ∩ ( d n . u r l ≠ d m . u r l ) ifAbnormal_Behavior (DDoS)then M = { m 1 ,  ⋯ , m n ,  m m }, where m is the victim system /∗the host executes a DDoS attack∗/ i n t e r v a l ( H → M ) ≅ 0 f r e q u e n c y ( H → M ) > θ m ifAbnormal_Behavior (IP-spoofed DDoS)then ( h n . m a c = h m . m a c ) ∩ ( h n . S i p ≠ h m . S i p ) f r e q u e n c y ( H → M ) > θ nTable 3
Attack pattern chain (APChain) algorithm.
Algorithm 2. Attack pattern chain (APChain)  /∗ T ⟵ set of packets ∗/  Function APChain (T): While(not stop condition)do C ⟵ ∅ /∗ Array for record ofAPChain∗/ forT is not Ødo C n . s n ⟵ s e q u e n c e   n u m b e r /∗S00001∗/ C n . s g n ⟵ s e q u e n c e   g r o u p   n u m b e r /∗G00001∗/ C n . S i p ⟵ s o u r c e   I P /∗58.203.xxx.xxx∗/ C n . S p o r t ⟵ s o u r c e   p o r t /∗port number∗/ C n . D i p ⟵ d e s t i n a t i o n   I P /∗211.106.xxx.xxx∗/ C n . D p o r t ⟵ d e s t i n a t i o n   p o r t /∗port number∗/ C n . m a c ⟵ M A C   a d d r e s s /∗D0-27-88-47-15-4B∗/ C n . t s ⟵ a c c e s s   t i m e /∗2016.08.12 07:05:28∗/ C n . u r l ⟵ U R L /∗www.cnn.com∗/ C n . t i n ⟵ ( C n . a t - C n - 1 . a t ) /∗ the cycle interval between the previous packet and the current packet ∗/ C n . c n d ⟵ C a l l   F u n c t i o n   C N D ( C , T ) C n . r a t d ⟵ C a l l   F u n c t i o n   R A T D ( C , T ) C n . c n t i ⟵ C a l l   F u n c t i o n   C N T I ( C , T ) C n . a c t t i ⟵ C a l l   F u n c t i o n   A C T T I ( C , T ) C n . s c t t i ⟵ S q r t ( C n . r a t d - C n . a c t t i 2 / C n . c n t i )  Function CND (C,T): for T  i s  n o t  n u l l do if ( C n . s r c I P = C n - 1 . s r c I P ) ∩ ( C n . d s t I P = C n - 1 . d s t I P ) then a c c V a l  + =  1 return accVal  Function RATD (C,T): if C n . s r c I P = C n - 1 . s r c I P ∩ C n . d s t I P = C n - 1 . d s t I P then i n t e r V a l  =  C n . a t - C n - m . a t return interVal  Function CNTI (C,T): for T  i s  n o t  n u l l ∩ C n . a t - C n - m . a t ≤ 30 ( m i n u t e ) do if C n . s r c I P = C n - 1 . s r c I P ∩ C n . d s t I P = C n - 1 . d s t I P then a c c V a l  + =  1 return accVal  Function ACTTI (C,T): for T  i s  n o t  n u l l ∩ C n . a t - C n - m . a t ≤ 30 ( m i n u t e ) do if C n . s r c I P = C n - 1 . s r c I P ∩ C n . d s t I P = C n - 1 . d s t I P then i n t e r V a l  + =  C n . a t - C n - m . a t a c c V a l  + =  1 return i n t e r V a l / a c c V a lThe behavioral profiling algorithm in Table2 consists of case studies for three representative attack types. The first case analyzes theRATD,CNTI,ACTTI, andSCTTI field values ofAPChain and confirms whether there is communication with a C&C server to detect a C&C channel. The second case analyzes theURL,RATD, andCNTI fields ofAPChain and checks for website tampering in order to detect pharming attacks. The third case analyzes theRATD,CNTI,ACTTI, andMAC fields ofAPChain and checks for IP-spoofing by calculating the traffic frequency in order to detect IP-spoofing DDoS botnets. Figure 3 presents the abnormal behavior detection process ofAPChain-based behavioral profiling in a real-time network environment.Figure 3
Abnormal behavior detection usingAPChain and behavioral profiling.


### 3.4. Elimination of Whitelist-Based False Positives

In this paper, we target the early detection of abnormal behavior usingAPChain and behavioral profiling. However, because the proposed methodology utilizes the attribute information of network traffic, false positives may occur when normal traffic is included in the detection results. For this reason, the proposed algorithm exchanges data with the external system or categorizes normal traffic such as web service calls based on a whitelist and eliminates them from the analysis [16, 17].The IP addresses registered on the whitelist are classified into two types. The first type is those that are part of theInternal Whitelist, which has packet attributes (e.g., Sip, Dip, and interval) regularly exchanged between the internal and external environments. When batch scripts such as crontab are used in the communication with the external environment for data exchange, theInternal Whitelist compares and analyzes the IP address, port, and execution cycle and saves the analysis in a file.However, it is difficult to detect abnormal behavior when it is registered with theInternal Whitelist because it is categorized as trustworthy communication. Therefore, the condition of (1) is periodically checked to detect the abnormal behavior of the hosts registered in theInternal Whitelist; any abnormal behavior detected will be excluded from theInternal Whitelist.(1)ifintervalServersrc⟷Serverdst≡θthennormal  network  trafficotherwiseabnormal  network  trafficThe second type of IP address is those associated with sites on well-knownGlobal Whitelists, such as those compiled by antivirus software companies. Through the continuous updating of theGlobal Whitelist, new C&C IP addresses are added, and IP addresses and domain names are included. Figure 4 outlines the elimination of whitelist-based normal IP addresses from the behavior profiling process.Figure 4
Elimination of whitelist-based false positives.The elimination process for whitelist-based false positives is shown in Figure4. The traffic from January to June 2017 collected in the experimental environment presented in Figure 10 is analyzed and whitelist-based IP addresses involved in normal communication are eliminated from the analysis.


### 3.5. Characteristics of C&C Channels and Their Detection Method

#### 3.5.1. Characteristics of C&C Channels

Attackers use either an encrypted communications channel or an alternative communication method to hide C&C channels. When hosts infected with malicious code establish an Internet-enabled communications environment, a channel is created to communicate with a C&C server and, through this, the infected host receives an attack command from the C&C server or extracts vital data from the host on its internal network [7, 18–20]. A C&C server can have at least 1 and up to N number of C&C channels with hosts and involves repeated connection and standby requests. Because the communication cycles of C&C channels differ depending on the characteristics of the malicious code, it is impossible to detect all C&C channels in categorized regular time intervals. Even though a C&C channel may exist between a host and a C&C server according to the configuration conditions, this does not mean that communication will always occur on a regular cycle. Moreover, a host infected with malicious code downloads the IP address of a new C&C server from the original C&C server and creates a communication channel with this new server. Figure 5 shows the connection and standby cycles of a C&C channel connection to a Linux/Xor.DDoS botnet.Figure 5
Characteristics of a Linux/Xor.DDoS botnet C&C channel.


#### 3.5.2. C&C Channel Detection Method

Analysis of the real-time traffic occurring in the experimental environment allowed us to categorize C&C channels into three types. The first type either engages in socket communication with the external server via the Internet to exchange data or uses a file transfer program such as the File Transfer Protocol (FTP) to exchange data with anonymous or authenticated users. In instances such as this, in which data is exchanged with the external system, a high connection frequency is observed at regular time intervals. The second type is when a connection is made to the website through browsers to surf the web. The host connects to a specific website and regularly requests a service or requests a random service from an unspecified website. In the case where a service is requested via a website, the connection frequency has significant variation at random time intervals. The third type is when a host is infected by malicious code upon connecting to a botnet or malicious code distribution site and attempts to communicate with an external network. The infected host configures a communication channel with the C&C server and either receives an attack command or updates the configuration file. When communication with a C&C server occurs, the connection cycle varies according to the characteristics of the malicious code and exhibits a high connection frequency.Further analysis of the network traffic characteristics over time confirms that, according to the traffic type, a difference occurs between the connection frequency and connection time intervals. Figure6 presents the connection frequency and intervals for three types of traffic: a C&C channel used to communicate with a C&C server, communication with an external file exchange system to exchange data, and website service requests made upon connecting to a website. If it were possible to analyze the traffic collected in real time, as was done in the experimental environment, it would be possible to detect attacks that have singularities such as those of the C&C channel.Figure 6
Analysis of network flow characteristics over time.In this paper, the following attributes are used to analyze the characteristics of a C&C channel and its connection frequency to configureAPChain:CND,RATD,ACTTI, andSCTTI. The time interval for the analysis of the traffic attributes is set to 30 minutes. The reason for this is because the average lead time for a host infected by malicious code to perform malicious activity is three hours. Therefore, the goal is to detect abnormal behavior using the proposed algorithm before the infected host can initiate malicious activities.


### 3.6. Characteristics of Pharming

Pharming is a type of cyber-attack in which specific domain names such as a cache DNS server are configured to use a forged IP address. Users input a normal website address to request a web service but are instead connected to a fake site created by the attacker. The fake site has the same form as the normal website and obtains personal information such as a user’s login credentials and account information. Therefore, an effective method to detect pharming attacks is to identify real websites and detect whether the DNS cache information has been falsified or not.The proposed methodology analyzes the traffic attribute information over time and categorizes pharming attacks. For example, when a host is infected by a pharming attack, even if it were to request a normal website, as in Figure7, a fake website is delivered with a falsified domain name and, as (2) shows, the number of calls to the fake website increases at a specific point in time.(2)H=H1,H2,H3H1=kbank.com,H2=hbank.com,H3=bbank.comP=PharmingSiteP⟵HIn this paper, to detect pharming attacks, the URL and IP address of the website the host is connecting to and the connection time are analyzed to configureAPChain.APChain’sURL,Dip,CND,RATD, andCNTI are used as key elements in behavioral profiling to detect pharming attacks.Figure 7
Flowchart of a pharming attack.


### 3.7. Characteristics of IP-Spoofing DDoS Botnets

Because of the increase in network bandwidth and the development of hardware, recent DDoS attacks are generating larger volumes of traffic incomparable to what has been seen in the past [21, 22]. Malicious code such as IP-spoofing DDoS botnets Linux.Shelldos and Linux.Xor.DDoS receives attack commands from a C&C server and generates large volumes of packets threatening to paralyze communications.Although security systems such as firewalls are set up to detect and block this type of attack, if a host infected by malicious code were to manifest large numbers of DDoS attacks, then even if a security system were to detect the DDoS attacks and block them, the internal network could be paralyzed due to the large volume of traffic. Therefore, if a host infected by an IP-spoofing DDoS attack is not detected and eliminated quickly, the internal network will be subject to the threat for a very long period of time.Figure8(a) shows that the internal network is affected by a large amount of traffic originating from a host infected with a DDoS botnet. Figure 8(b) presents the traffic from the internal network using PRTG software. The infected host generates a large volume of traffic from the host to the external server and failures occur on the internal network. Figure 9 shows the packets generated from a host infected by an IP-spoofing DDoS botnet.Figure 8
Analysis of DDoS characteristics.
(a)
IP-spoofing DDoS traffic flowchart (b)
Network bandwidth usageFigure 9
Traffic of a host infected by an IP-spoofing DDoS botnet.Figure 10
Diagram of the experimental environment.In this paper, to detect IP-spoofing DDoS botnets, the attributes of outbound traffic are analyzed, and the following values are used to configureAPChain:Sip,Sport,MAC,CND,RATD,CNTI,ACTTI, andSCTTI. Additionally, behavioral profiling is used to confirm whether IP-spoofing has occurred or not and to identify the host IP infected by the botnet.


## 3.1. Overview of the Proposed Methodology

Recent cyber-attacks are initiated by using advanced social engineering or by sending a targeted e-mail to attack targets [15]. If a host is infected by malicious code, an attempt to communicate with a C&C server is made and a communications channel is formed using Internet Remote Chat (IRC) or an HTTP protocol. When a communications channel is established, the host receives an attack command from the C&C server or updates the binary file. At this time,APChain is configured to monitor real-time traffic and detect abnormal behavior, followed by behavioral profiling.The methodology proposed in this paper is presented in Figure1. It consists of a five-step process to detect abnormal behavior. First, real-time traffic is collected by the flow collector and attribute information from the collected traffic is extracted. Second, this traffic attribute information is analyzed in order to configureAPChain.APChain’s role is to connect the features of the traffic attribute information into a chain and to match this to abnormal behavior. Third, behavioral profiling based onAPChain is conducted. Fourth, suspicious patterns are categorized and abnormal behavior is detected. Finally, intrusion responses against the abnormal behavior are executed, and network forensics for an audit trail are conducted.Figure 1
Conceptual diagram of the proposed methodology.


## 3.2. Attack Pattern Chain Algorithm (APChain)

In order to detect abnormal behavior, attribute information is extracted from the DMZ or the internal backbone switch, and a chain is configured that contains the attribute information over time.


### 3.2.1. Attribute Information forAPChain

Network traffic headers contain a variety of information such as the IP addresses and protocols of the origin and destination. The standardized extraction defined by the communication protocol enables efficient analysis. An 8-tuplesource IP, source port, destination IP, destination port, protocol, access time, MAC, URL, which contains the fundamental attribute information required to createAPChain, is extracted from the traffic header and payload, and a 10-tuple SN,SGN,TIN,CND,RATD,CNTI,RATD,CNTI,ACTTI,SCTTI is created, which provides additional attribute information based on the extracted 8-tuple. The 8-tuple defines the network connection between the origin and the destination systems, and the 10-tuple is utilized as analysis data for the detection of a host’s abnormal behavior.


### 3.2.2. Execution Results ofAPChain

The 8-tuplesource IP, source port, destination IP, destination port, protocol, time, MAC, URL, collected through the network switch of the experimental environment depicted in Figure 10, is used as input to createAPChain. The results using theAPChain algorithm in Table 3 are expressed as Output=Input ∪SN,SGN,TIN,CND,RATD,CNTI,RATD,CNTI,ACTTI,SCTTI. Table 1 presents theAPChain table created using the traffic attribute information.Table 1
APChain table.
Attribute Type Description SN Varchar Sequence number  SGN Varchar Sequence group number with the same destination IP  Sip Varchar Source IP  Sport Integer Source port  Dip Varchar Destination IP  Dport Integer Destination port  MAC Varchar Media Access Control address  PT Varchar Protocol  TS Date Time stamp  URL Varchar Uniform Resource Locator address  TIN Integer TIN subtracts the previous access time from the current access time  CND Integer CND is the cumulative number of times a connection is made to the same target IP address  RATD Integer RATD is the connection time interval to the same target IP address  CNTI Integer CNTI is the cumulative number of times a connection is made to the same target IP address over 30 minutes  ACTTI Integer ACTTI is the average connection time interval to the same target IP address over 30 minutes  SCTTI Integer SCTTI is the standard deviation of the connection time interval to the same target IP address over 30 minutesFigure2 shows an example ofAPChain configuration for the abnormal traffic behavior of a host infected by malicious code.Figure 2
Conceptual diagram ofAPChain configuration.For example, the intrusion server (217.11.xxx.78) connects to the malicious server (12.5.xxx.48), which distributes malicious code, infecting the host. The infected host periodically communicates with the C&C server (106.23.xxx.129) and updates the binary malicious code or receives an attack command. At this time, to configureAPChain to detect abnormal behavior, port mirroring is configured on the backbone switch, and network traffic attribute information is extracted to createAPChain. This traffic attribute information is utilized to calculate additional attributes and added toAPChain.When connections are made to a web server with the same target address, they are defined inAPChain by the same group name, “GXXX53-PXXXX,” and, after they are interconnected in the chain, behavioral profiling is conducted to detect abnormal behavior.


## 3.2.1. Attribute Information forAPChain

Network traffic headers contain a variety of information such as the IP addresses and protocols of the origin and destination. The standardized extraction defined by the communication protocol enables efficient analysis. An 8-tuplesource IP, source port, destination IP, destination port, protocol, access time, MAC, URL, which contains the fundamental attribute information required to createAPChain, is extracted from the traffic header and payload, and a 10-tuple SN,SGN,TIN,CND,RATD,CNTI,RATD,CNTI,ACTTI,SCTTI is created, which provides additional attribute information based on the extracted 8-tuple. The 8-tuple defines the network connection between the origin and the destination systems, and the 10-tuple is utilized as analysis data for the detection of a host’s abnormal behavior.


## 3.2.2. Execution Results ofAPChain

The 8-tuplesource IP, source port, destination IP, destination port, protocol, time, MAC, URL, collected through the network switch of the experimental environment depicted in Figure 10, is used as input to createAPChain. The results using theAPChain algorithm in Table 3 are expressed as Output=Input ∪SN,SGN,TIN,CND,RATD,CNTI,RATD,CNTI,ACTTI,SCTTI. Table 1 presents theAPChain table created using the traffic attribute information.Table 1
APChain table.
Attribute Type Description SN Varchar Sequence number  SGN Varchar Sequence group number with the same destination IP  Sip Varchar Source IP  Sport Integer Source port  Dip Varchar Destination IP  Dport Integer Destination port  MAC Varchar Media Access Control address  PT Varchar Protocol  TS Date Time stamp  URL Varchar Uniform Resource Locator address  TIN Integer TIN subtracts the previous access time from the current access time  CND Integer CND is the cumulative number of times a connection is made to the same target IP address  RATD Integer RATD is the connection time interval to the same target IP address  CNTI Integer CNTI is the cumulative number of times a connection is made to the same target IP address over 30 minutes  ACTTI Integer ACTTI is the average connection time interval to the same target IP address over 30 minutes  SCTTI Integer SCTTI is the standard deviation of the connection time interval to the same target IP address over 30 minutesFigure2 shows an example ofAPChain configuration for the abnormal traffic behavior of a host infected by malicious code.Figure 2
Conceptual diagram ofAPChain configuration.For example, the intrusion server (217.11.xxx.78) connects to the malicious server (12.5.xxx.48), which distributes malicious code, infecting the host. The infected host periodically communicates with the C&C server (106.23.xxx.129) and updates the binary malicious code or receives an attack command. At this time, to configureAPChain to detect abnormal behavior, port mirroring is configured on the backbone switch, and network traffic attribute information is extracted to createAPChain. This traffic attribute information is utilized to calculate additional attributes and added toAPChain.When connections are made to a web server with the same target address, they are defined inAPChain by the same group name, “GXXX53-PXXXX,” and, after they are interconnected in the chain, behavioral profiling is conducted to detect abnormal behavior.


## 3.3. Behavioral Profiling

Behavioral profiling analyzes attack types based on their characteristics and categorizes any traffic that exhibits abnormal behavior. Table2 shows the behavioral profiling algorithm usingAPChain.Table 2
Behavioral profiling algorithm.
Algorithm 1. Behavioral Profiling  Input: Result of Function APChain (T): where T is a collection of network traffic. Output: Results of abnormal behavior Function Behavioral_Profiling (T): H = h 1 ,  ⋯ , h n ,  h m, where h is the host infected by malware D = d 1 ,  ⋯ , d n , d m, where d represents destination servers R ⟵ RATD field value of APChain C ⟵ CNTI field value of APChain A ⟵ ACTTI field value of APChain S ⟵ SCTTI field value of APChain while(not stop condition)do ifAbnormal_Behavior C&Cthen M = m 1 ,  ⋯ , m n ,  m m, where m is the C&C server /∗the host attempts to connect to the C&C server∗/ i n t e r v a l H → M ∈ ( A ± S ) f r e q u e n c y ( H → M ) > C ifAbnormal_Behavior (Pharming)then M = { m 1 ,  ⋯ , m n ,  m m }, where m is the fake website /∗the host connects to the fake website∗/ i n t e r v a l ( H → M ) < θ i f r e q u e n c y ( H → M ) > θ j ( d n . D i p = d m . D i p )  ∩ ( d n . u r l ≠ d m . u r l ) ifAbnormal_Behavior (DDoS)then M = { m 1 ,  ⋯ , m n ,  m m }, where m is the victim system /∗the host executes a DDoS attack∗/ i n t e r v a l ( H → M ) ≅ 0 f r e q u e n c y ( H → M ) > θ m ifAbnormal_Behavior (IP-spoofed DDoS)then ( h n . m a c = h m . m a c ) ∩ ( h n . S i p ≠ h m . S i p ) f r e q u e n c y ( H → M ) > θ nTable 3
Attack pattern chain (APChain) algorithm.
Algorithm 2. Attack pattern chain (APChain)  /∗ T ⟵ set of packets ∗/  Function APChain (T): While(not stop condition)do C ⟵ ∅ /∗ Array for record ofAPChain∗/ forT is not Ødo C n . s n ⟵ s e q u e n c e   n u m b e r /∗S00001∗/ C n . s g n ⟵ s e q u e n c e   g r o u p   n u m b e r /∗G00001∗/ C n . S i p ⟵ s o u r c e   I P /∗58.203.xxx.xxx∗/ C n . S p o r t ⟵ s o u r c e   p o r t /∗port number∗/ C n . D i p ⟵ d e s t i n a t i o n   I P /∗211.106.xxx.xxx∗/ C n . D p o r t ⟵ d e s t i n a t i o n   p o r t /∗port number∗/ C n . m a c ⟵ M A C   a d d r e s s /∗D0-27-88-47-15-4B∗/ C n . t s ⟵ a c c e s s   t i m e /∗2016.08.12 07:05:28∗/ C n . u r l ⟵ U R L /∗www.cnn.com∗/ C n . t i n ⟵ ( C n . a t - C n - 1 . a t ) /∗ the cycle interval between the previous packet and the current packet ∗/ C n . c n d ⟵ C a l l   F u n c t i o n   C N D ( C , T ) C n . r a t d ⟵ C a l l   F u n c t i o n   R A T D ( C , T ) C n . c n t i ⟵ C a l l   F u n c t i o n   C N T I ( C , T ) C n . a c t t i ⟵ C a l l   F u n c t i o n   A C T T I ( C , T ) C n . s c t t i ⟵ S q r t ( C n . r a t d - C n . a c t t i 2 / C n . c n t i )  Function CND (C,T): for T  i s  n o t  n u l l do if ( C n . s r c I P = C n - 1 . s r c I P ) ∩ ( C n . d s t I P = C n - 1 . d s t I P ) then a c c V a l  + =  1 return accVal  Function RATD (C,T): if C n . s r c I P = C n - 1 . s r c I P ∩ C n . d s t I P = C n - 1 . d s t I P then i n t e r V a l  =  C n . a t - C n - m . a t return interVal  Function CNTI (C,T): for T  i s  n o t  n u l l ∩ C n . a t - C n - m . a t ≤ 30 ( m i n u t e ) do if C n . s r c I P = C n - 1 . s r c I P ∩ C n . d s t I P = C n - 1 . d s t I P then a c c V a l  + =  1 return accVal  Function ACTTI (C,T): for T  i s  n o t  n u l l ∩ C n . a t - C n - m . a t ≤ 30 ( m i n u t e ) do if C n . s r c I P = C n - 1 . s r c I P ∩ C n . d s t I P = C n - 1 . d s t I P then i n t e r V a l  + =  C n . a t - C n - m . a t a c c V a l  + =  1 return i n t e r V a l / a c c V a lThe behavioral profiling algorithm in Table2 consists of case studies for three representative attack types. The first case analyzes theRATD,CNTI,ACTTI, andSCTTI field values ofAPChain and confirms whether there is communication with a C&C server to detect a C&C channel. The second case analyzes theURL,RATD, andCNTI fields ofAPChain and checks for website tampering in order to detect pharming attacks. The third case analyzes theRATD,CNTI,ACTTI, andMAC fields ofAPChain and checks for IP-spoofing by calculating the traffic frequency in order to detect IP-spoofing DDoS botnets. Figure 3 presents the abnormal behavior detection process ofAPChain-based behavioral profiling in a real-time network environment.Figure 3
Abnormal behavior detection usingAPChain and behavioral profiling.


## 3.4. Elimination of Whitelist-Based False Positives

In this paper, we target the early detection of abnormal behavior usingAPChain and behavioral profiling. However, because the proposed methodology utilizes the attribute information of network traffic, false positives may occur when normal traffic is included in the detection results. For this reason, the proposed algorithm exchanges data with the external system or categorizes normal traffic such as web service calls based on a whitelist and eliminates them from the analysis [16, 17].The IP addresses registered on the whitelist are classified into two types. The first type is those that are part of theInternal Whitelist, which has packet attributes (e.g., Sip, Dip, and interval) regularly exchanged between the internal and external environments. When batch scripts such as crontab are used in the communication with the external environment for data exchange, theInternal Whitelist compares and analyzes the IP address, port, and execution cycle and saves the analysis in a file.However, it is difficult to detect abnormal behavior when it is registered with theInternal Whitelist because it is categorized as trustworthy communication. Therefore, the condition of (1) is periodically checked to detect the abnormal behavior of the hosts registered in theInternal Whitelist; any abnormal behavior detected will be excluded from theInternal Whitelist.(1)ifintervalServersrc⟷Serverdst≡θthennormal  network  trafficotherwiseabnormal  network  trafficThe second type of IP address is those associated with sites on well-knownGlobal Whitelists, such as those compiled by antivirus software companies. Through the continuous updating of theGlobal Whitelist, new C&C IP addresses are added, and IP addresses and domain names are included. Figure 4 outlines the elimination of whitelist-based normal IP addresses from the behavior profiling process.Figure 4
Elimination of whitelist-based false positives.The elimination process for whitelist-based false positives is shown in Figure4. The traffic from January to June 2017 collected in the experimental environment presented in Figure 10 is analyzed and whitelist-based IP addresses involved in normal communication are eliminated from the analysis.


## 3.5. Characteristics of C&C Channels and Their Detection Method

### 3.5.1. Characteristics of C&C Channels

Attackers use either an encrypted communications channel or an alternative communication method to hide C&C channels. When hosts infected with malicious code establish an Internet-enabled communications environment, a channel is created to communicate with a C&C server and, through this, the infected host receives an attack command from the C&C server or extracts vital data from the host on its internal network [7, 18–20]. A C&C server can have at least 1 and up to N number of C&C channels with hosts and involves repeated connection and standby requests. Because the communication cycles of C&C channels differ depending on the characteristics of the malicious code, it is impossible to detect all C&C channels in categorized regular time intervals. Even though a C&C channel may exist between a host and a C&C server according to the configuration conditions, this does not mean that communication will always occur on a regular cycle. Moreover, a host infected with malicious code downloads the IP address of a new C&C server from the original C&C server and creates a communication channel with this new server. Figure 5 shows the connection and standby cycles of a C&C channel connection to a Linux/Xor.DDoS botnet.Figure 5
Characteristics of a Linux/Xor.DDoS botnet C&C channel.


### 3.5.2. C&C Channel Detection Method

Analysis of the real-time traffic occurring in the experimental environment allowed us to categorize C&C channels into three types. The first type either engages in socket communication with the external server via the Internet to exchange data or uses a file transfer program such as the File Transfer Protocol (FTP) to exchange data with anonymous or authenticated users. In instances such as this, in which data is exchanged with the external system, a high connection frequency is observed at regular time intervals. The second type is when a connection is made to the website through browsers to surf the web. The host connects to a specific website and regularly requests a service or requests a random service from an unspecified website. In the case where a service is requested via a website, the connection frequency has significant variation at random time intervals. The third type is when a host is infected by malicious code upon connecting to a botnet or malicious code distribution site and attempts to communicate with an external network. The infected host configures a communication channel with the C&C server and either receives an attack command or updates the configuration file. When communication with a C&C server occurs, the connection cycle varies according to the characteristics of the malicious code and exhibits a high connection frequency.Further analysis of the network traffic characteristics over time confirms that, according to the traffic type, a difference occurs between the connection frequency and connection time intervals. Figure6 presents the connection frequency and intervals for three types of traffic: a C&C channel used to communicate with a C&C server, communication with an external file exchange system to exchange data, and website service requests made upon connecting to a website. If it were possible to analyze the traffic collected in real time, as was done in the experimental environment, it would be possible to detect attacks that have singularities such as those of the C&C channel.Figure 6
Analysis of network flow characteristics over time.In this paper, the following attributes are used to analyze the characteristics of a C&C channel and its connection frequency to configureAPChain:CND,RATD,ACTTI, andSCTTI. The time interval for the analysis of the traffic attributes is set to 30 minutes. The reason for this is because the average lead time for a host infected by malicious code to perform malicious activity is three hours. Therefore, the goal is to detect abnormal behavior using the proposed algorithm before the infected host can initiate malicious activities.


## 3.5.1. Characteristics of C&C Channels

Attackers use either an encrypted communications channel or an alternative communication method to hide C&C channels. When hosts infected with malicious code establish an Internet-enabled communications environment, a channel is created to communicate with a C&C server and, through this, the infected host receives an attack command from the C&C server or extracts vital data from the host on its internal network [7, 18–20]. A C&C server can have at least 1 and up to N number of C&C channels with hosts and involves repeated connection and standby requests. Because the communication cycles of C&C channels differ depending on the characteristics of the malicious code, it is impossible to detect all C&C channels in categorized regular time intervals. Even though a C&C channel may exist between a host and a C&C server according to the configuration conditions, this does not mean that communication will always occur on a regular cycle. Moreover, a host infected with malicious code downloads the IP address of a new C&C server from the original C&C server and creates a communication channel with this new server. Figure 5 shows the connection and standby cycles of a C&C channel connection to a Linux/Xor.DDoS botnet.Figure 5
Characteristics of a Linux/Xor.DDoS botnet C&C channel.


## 3.5.2. C&C Channel Detection Method

Analysis of the real-time traffic occurring in the experimental environment allowed us to categorize C&C channels into three types. The first type either engages in socket communication with the external server via the Internet to exchange data or uses a file transfer program such as the File Transfer Protocol (FTP) to exchange data with anonymous or authenticated users. In instances such as this, in which data is exchanged with the external system, a high connection frequency is observed at regular time intervals. The second type is when a connection is made to the website through browsers to surf the web. The host connects to a specific website and regularly requests a service or requests a random service from an unspecified website. In the case where a service is requested via a website, the connection frequency has significant variation at random time intervals. The third type is when a host is infected by malicious code upon connecting to a botnet or malicious code distribution site and attempts to communicate with an external network. The infected host configures a communication channel with the C&C server and either receives an attack command or updates the configuration file. When communication with a C&C server occurs, the connection cycle varies according to the characteristics of the malicious code and exhibits a high connection frequency.Further analysis of the network traffic characteristics over time confirms that, according to the traffic type, a difference occurs between the connection frequency and connection time intervals. Figure6 presents the connection frequency and intervals for three types of traffic: a C&C channel used to communicate with a C&C server, communication with an external file exchange system to exchange data, and website service requests made upon connecting to a website. If it were possible to analyze the traffic collected in real time, as was done in the experimental environment, it would be possible to detect attacks that have singularities such as those of the C&C channel.Figure 6
Analysis of network flow characteristics over time.In this paper, the following attributes are used to analyze the characteristics of a C&C channel and its connection frequency to configureAPChain:CND,RATD,ACTTI, andSCTTI. The time interval for the analysis of the traffic attributes is set to 30 minutes. The reason for this is because the average lead time for a host infected by malicious code to perform malicious activity is three hours. Therefore, the goal is to detect abnormal behavior using the proposed algorithm before the infected host can initiate malicious activities.


## 3.6. Characteristics of Pharming

Pharming is a type of cyber-attack in which specific domain names such as a cache DNS server are configured to use a forged IP address. Users input a normal website address to request a web service but are instead connected to a fake site created by the attacker. The fake site has the same form as the normal website and obtains personal information such as a user’s login credentials and account information. Therefore, an effective method to detect pharming attacks is to identify real websites and detect whether the DNS cache information has been falsified or not.The proposed methodology analyzes the traffic attribute information over time and categorizes pharming attacks. For example, when a host is infected by a pharming attack, even if it were to request a normal website, as in Figure7, a fake website is delivered with a falsified domain name and, as (2) shows, the number of calls to the fake website increases at a specific point in time.(2)H=H1,H2,H3H1=kbank.com,H2=hbank.com,H3=bbank.comP=PharmingSiteP⟵HIn this paper, to detect pharming attacks, the URL and IP address of the website the host is connecting to and the connection time are analyzed to configureAPChain.APChain’sURL,Dip,CND,RATD, andCNTI are used as key elements in behavioral profiling to detect pharming attacks.Figure 7
Flowchart of a pharming attack.


## 3.7. Characteristics of IP-Spoofing DDoS Botnets

Because of the increase in network bandwidth and the development of hardware, recent DDoS attacks are generating larger volumes of traffic incomparable to what has been seen in the past [21, 22]. Malicious code such as IP-spoofing DDoS botnets Linux.Shelldos and Linux.Xor.DDoS receives attack commands from a C&C server and generates large volumes of packets threatening to paralyze communications.Although security systems such as firewalls are set up to detect and block this type of attack, if a host infected by malicious code were to manifest large numbers of DDoS attacks, then even if a security system were to detect the DDoS attacks and block them, the internal network could be paralyzed due to the large volume of traffic. Therefore, if a host infected by an IP-spoofing DDoS attack is not detected and eliminated quickly, the internal network will be subject to the threat for a very long period of time.Figure8(a) shows that the internal network is affected by a large amount of traffic originating from a host infected with a DDoS botnet. Figure 8(b) presents the traffic from the internal network using PRTG software. The infected host generates a large volume of traffic from the host to the external server and failures occur on the internal network. Figure 9 shows the packets generated from a host infected by an IP-spoofing DDoS botnet.Figure 8
Analysis of DDoS characteristics.
(a)
IP-spoofing DDoS traffic flowchart (b)
Network bandwidth usageFigure 9
Traffic of a host infected by an IP-spoofing DDoS botnet.Figure 10
Diagram of the experimental environment.In this paper, to detect IP-spoofing DDoS botnets, the attributes of outbound traffic are analyzed, and the following values are used to configureAPChain:Sip,Sport,MAC,CND,RATD,CNTI,ACTTI, andSCTTI. Additionally, behavioral profiling is used to confirm whether IP-spoofing has occurred or not and to identify the host IP infected by the botnet.


## 4. System Model

In this section, we outline the proposed algorithm for detecting abnormal behavior and examine the abnormal behavior detection methods according to attack type in the form of case studies.


### 4.1. Collection of Network Traffic

Port mirroring is configured to the backbone switch for the collection of real-time network traffic. Port mirroring is set up to collect all of the traffic routed from the backbone switch to analyze the attribute information. Figure10 presents a diagram outlining the collection of real-time network traffic.


### 4.2. Extraction of Attribute Information

Attribute information extracted from real-time traffic in the experimental environment presented in Figure10 is stored in the flow log database (FLDB). The FLDB stores the features of the attributes extracted from the traffic headers, both normal and malicious traffic (e.g., Trojans, botnets, etc.) is included.The collection of network traffic collected at the backbone switch is represented as T=t1, ⋯,tn-1,tn, and the traffic attribute information is defined as t=tip,tport,ttime,tmac, ⋯,turl. The size of the attribute information stored in the FLDB is F=∑i=1n1 and is cumulatively calculated if new attribute information is stored in the FLDB. The protocol stack for extracting packet attribute information is shown in Figure 11.Figure 11
Protocol stack for feature vector extraction.


### 4.3. Attack Pattern Chain (APChain) Creation

TheAPChain algorithm configures a chain of traffic attribute information over time. Behavioral profiling usingAPChain is then conducted to detect abnormal behavior. Table 3 shows the algorithm used to configureAPChain using traffic attribute information extracted from the protocol stack (Figure 11).The source IP, source port, destination IP, destination port, access time, andMAC value are extracted from the network traffic, and the URL information from the payload is analyzed to configureAPChain. Additionally, the connection time and connection frequency of traffic that have the same target IP address are calculated and stored withinAPChain.APChain record is 102 Bytes in size, and the same number ofAPChain records is created as the number of transfers inbound to outbound. Figure 12 shows the results ofAPChain creation using attribution information from the collected traffic.Figure 12
Results of the execution of theAPChain algorithm.


### 4.4. Abnormal Behavior Detection Using Behavioral Profiling

In this section, we will review the process and algorithm for behavior profiling usingAPChain and investigate the detection of abnormal behavior using three case studies.


#### 4.4.1. C&C Channel Detection [Case Study A]

Hosts are infected with malicious code by malicious code distribution sites, phishing emails, or social networks. Infected hosts attempt to connect to receive an attack command from a C&C server, to update the C&C server list, or to update the binary file. At this time, the C&C channel uses random ports higher than the known ports and configures a channel with at least one C&C server. Therefore, one method to effectively block botnet attacks is to detect the communication channel with the C&C server and eliminate it before the host infected by malicious code can manifest an attack. The hypothesis that we established for C&C channel detection is presented in Table4. C&C channel detection results are verified in the experiments.Table 4
The hypothesis for C&C channel detection.
Hypothesis 1. C&C channel detection  Given an environment: LetT=t1,⋯,tn-1,tn, where t represents the network traffic, and Tn is the traffic currently being analyzed. LetH=h1,⋯,hn-1,hn, where h represents a host infected by malicious code. LetS=s1,⋯,sn-1,sn, where s represents a C&C server. H ⟹ S, the infected host attempts to connect to the C&C server. A host infected with a botnet creates a C&C channel in order to communicate periodically with the C&C server. As a result, the frequency that a host connects to a particular system increases, and if this pattern is repeated often enough, it can be considered to be unusual traffic. At this point, the host and the C&C server receive attack commands or update binary files while repeating the connection requests and responses. Therefore, the set (G) of C&C channels can be formed by detecting and grouping the requests from hosts connecting to the C&C server. G =H1⟹S1, H2⟹S2, ⋯, Hn-1⟹Sn-1, Hn⟹SnThe commands used to trigger communication between the host and the C&C server are included in a botnet, and the communication method for the creation of the C&C channel and connection cycle are configured. Therefore, if we can detect hosts infected by malicious code connecting to a C&C server, then we can block the attack before the actual attack can be manifested.In this paper, the following process is followed to detect a C&C channel between a host infected by a botnet and a C&C server. First, it confirms if the traffic to be analyzed contains an IP address included as part of the whitelist-based false positive elimination process. If the IP address is included on the list, it is categorized as normal traffic, and if not, it is analyzed to determine abnormal behavior. Second, it calculates the frequency (CNTI) of the host connecting to the target system and compares it with the threshold value. If theCNTI value is higher than the threshold value, then it concludes that communications are occurring regularly and moves on to the next step. Third, it compares the connection time interval (RATD) for traffic that has the same target IP address with the average connection time interval calculated every 30 minutes. At this time, the standard deviation of the average connection time interval (SCTTI) is also calculated, and if the connection time interval (RATD) is {ACTTI-SCTTI±θi≤(RATD)≥(ACTTI+SCTTI)±θj}, then the corresponding traffic is suspected to be a C&C channel. Figure 13 displays the distribution of the connection frequencies and connection cycles of traffic suspected to be C&C channels. Finally, if the connection frequency of a bot to a suspected C&C channel exceeds the threshold value, it is categorized as abnormal traffic behavior.Figure 13
Categorization of abnormal traffic behavior suspected of being a C&C channel.Normal packets and abnormal packets can be categorized by analyzing the network traffic collected in the experimental environment shown in Figure10, and traffic suspected as being a C&C channel can be categorized according to the hypothesis defined in Table 4.Figure13 presents the connection frequency between a host and a suspected C&C channel. IfAPChain’sACTTI isA andSCTTI isS withAPChain connection frequency asx, then, for the traffic suspected as being a C&C channel,C is C={x∣∃x,(A-S)±θi≤x≥(A+S)±θj}. Here,ACTTI is used as the reference value for C&C channel detection. A fixed value is not used; it varies according to the connection cycle of the target IP address. Table 5 presents the algorithm used to detect a C&C channel. The proposed algorithm was developed into a prototype, and its performance is verified in the experiment and evaluation sections of this paper.Table 5
C&C channel detection algorithm.
Algorithm 3. C&C channel detection  /∗ T ⟵ set of packets ∗/ /∗ C ⟵ set of APChain fields ∗/  Function Behavioral_Profiling (T): While(not stop condition)do C ⟵ C a l l   F u n c t i o n   A P C h a i n   ( T )  for T   i s   n o t   n u l l do if(C.cnti≥θi)∩(C.cnti≤θj)then ∃ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   a b n o r m a l   t r a f f i c ) if C . r a t d - C . a c t t i ± C . s c t t i   ≤   θ x then ∀ T ( T   i s   a b n o r m a l   t r a f f i c ) a c c V a l   + = 1 if a c c V a l > θ y then ∀ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   a   C & C   c h a n n e l ) if T ∉ I n t e r n a l   W h i t e l i s t   ( T ) then ∀ T ( T   i s   a   C & C   c h a n n e l ) return T   i s   a   C & C   c h a n n e l


#### 4.4.2. Pharming Attack Detection [Case Study B]

Pharming attacks target specific individuals or organizations and infect them via spear phishing or malicious code distribution sites. Pharming attacks falsify Windows environment files or DNS addresses, so even if a host infected by pharming were to call a fake site, the intrusion response system would categorize the corresponding traffic as normal. The hypothesis for detecting a pharming attack is shown in Table6.Table 6
Hypothesis for detecting a pharming attack.
Hypothesis 2. Pharming attack detection  Given an environment: LetT=t1,⋯,tn-1,tn, where t represents the network traffic, and Tn is the traffic currently being analyzed. LetH=h1,⋯,hn-1,hn, where h is a host infected with malicious code. LetS=s1,⋯,sn-1,sn, where s is a fake website. H ⟹ S, the infected host connects to the fake website. The user requests a legitimate website, but a host infected with pharming redirects the connection to a fake website. At that time, when requesting the URL of the legitimate website, a connection to a specific destination IP address may be suspected as a pharming attack. Therefore, we analyze requested URLs from hosts and compare them to the IP addresses of destination websites. The set (G) contains hosts that request the same destination IP addresses. G =H1⟹S1, H2⟹S2, ⋯, Hn-1⟹Sn-1, Hn⟹SnThe algorithm to detect a pharming attack proposed in this paper analyzes whether the site that the host connects to is fake or not. For example, when the host attempts to connect to a website with a specific IP address through different domain names, it can be suspected of being a pharming attack. The average time interval of the connection to a fake website isRATD, and the frequency isCNTI. When the threshold isy, traffic suspected as pharming,P,is represented as P={x∣x∈thresholdy,RATD≤x∩CNTI≥x}. Table 7 presents the algorithm used to detect a pharming attack through behavioral profiling.Table 7
Pharming attack detection algorithm.
Algorithm 4. Pharming attack detection  /∗ T ⟵ set of packets ∗/ /∗ C ⟵ set of APChain fields ∗/  Function Behavioral_Profiling (T): while(not stop condition)do C ⟵ C a l l   F u n c t i o n   A P C h a i n   ( T ) forT is not nulldo if C n . D i p = C m . D i p ∩ C a l l   F u n c   n _ g r a m   ( C ) then ∃ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   p h a r m i n g ) a c c V a l + = 1 if a c c V a l ≥ θ i ∩ C . c n t i ≥ θ j ∩ C . r a t d ≥ θ k then /∗ Analysis of connections to websites suspected as pharming and connections to a specific target IP address ∗/ ∀ T ( T   i s   p h a r m i n g ) returnpharming  Function n-gram(C): if n _ g r a m ( C n . u r l ) ∈ C n - m . u r l then /∗ Accuracy is increased using the n-gram algorithm ∗/ return true


#### 4.4.3. IP-Spoofing DDoS Botnet Detection [Case Study C]

As advances in network infrastructure and hardware have progressed, the large volume of traffic generated from a small number of systems has become the main threat to the stability of an internal network. In particular, if malicious codes such as Windows or Linux-related DDoS botnets are not detected in time, then large volumes of traffic would be generated on the internal network, and we would face the threat of the entire network shutting down. Therefore, it is imperative to detect and effectively eliminate hosts infected with malicious code. However, it is not easy to detect hosts that manifest IP-spoofing DDoS attacks, and related research is limited. In this paper,APChain is configured, and we propose a method to detect IP-spoofing DDoS botnets through behavioral profiling. To maintain a communication channel with a C&C server, a host infected with an IP-spoofing DDoS botnet attempts to connect and, if successful, moves to a standby state to receive attack commands. If the host receives an attack command from the C&C server, it generates a large volume of dummy packets to send to the attack target destination. At this time, the source IP address of the packet uses a spoofed IP address and dummy data included in the payload and transfers them to the attack target system. The proposed methodology usesAPChain’s connection frequency (CND), connection time interval, and average connection time interval (ACTTI) values to conduct behavioral profiling and detect DDoS attacks. The hypothesis employed to detect IP-spoofing DDoS botnets is shown in Table 8.Table 8
Hypothesis for detecting IP-spoofing DDoS botnets.
Hypothesis  3. IP-spoofing DDoS botnet detection  Given an environment: LetT=t1,⋯,tn-1,tn, where t represents the network traffic, and Tn is the traffic currently being analyzed. LetH=h1,⋯,hn-1,hn, where h is a host infected with malicious code. LetD=d1,⋯,dn-1,dn, where d represents a target system for DDoS attack. H ⟹ D, the infected host executes a DDoS attack on the target system. A host infected with an IP-spoofing DDoS botnet receives an attack command from the C&C server and implements a DDoS attack, and the origin IP address of the host attacking with DDoS is modified. At that time, a DDoS attack can be suspected if the host sends large amounts of traffic to the destination system. Also, an IP-spoofing DDoS botnet can be categorized if a particular host has a different origin IP address but the same MAC address. Therefore, the set (G) consists of hosts that perform IP-spoofing DDoS attacks. G =H1⟹D1, H2⟹D2, ⋯, Hn-1⟹Dn-1, Hn⟹DnThe algorithm proposed to detect IP-spoofing DDoS botnets detects hosts that have different source IP addresses but that have the same MAC address. For example, when the traffic frequency for a host connecting to the target IP address isCNTI and the average connection cycle isACTTI, if the threshold value isy, then the traffic is suspected to be a DDoS attack,D, where D={x∣x∈threshold,CNTI≥θ∩ACTTI≈0}. At this time, if the traffic has different source IP addresses but the same MAC address, it is presumed to be an IP-spoofing DDoS botnet.The method used to detect an infected host is to search for the MAC address suspected to be a spoofed IP address in theMAC field of theAPChain table and to extract the record that was first registered in theAPChain table to confirm the source IP address. It is assumed that the host with the same IP address as the source IP address is a botnet. Table 9 summarizes the IP-spoofing DDoS botnet detection algorithm using behavioral profiling.Table 9
IP-spoofing DDoS botnet detection algorithm.
Algorithm 5. IP-spoofing DDoS botnet detection /∗T ⟵ set of packets ∗/ /∗ C ⟵ set of APChain fields ∗/  Function Behavioral_Profiling (T): while(not stop condition)do C ⟵ Call Function APChain (T) forT is not nulldo if C . c n t i ≥ θ i then if C . r a t d ≅ 0 ∩ ( C . a c t t i ≅ 0 ) then ∃ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   D D o S ) accVal1 += 1 if a c c V a l 1 ≥ θ j then ∀ T ( T   i s   a   D D o S   a t t a c k ) if ( C n . S i p ∈ C n + m . S i p ) ∩ ( C n . m a c ∈ C n + m . m a c ) then ∃ T ( T   i s   I P   s p o o f i n g ) a c c V a l 2 + = 1 if a c c V a l 2 ≥ θ j then ∀ T ( T   i s   a n   I P   s p o o f i n g   D D o S   a t t a c k ) returnCall Function infection_host (Cn.mac,C)  Function infection_host ( C . n . m a c , C ) while(not stop condition)do if ( C n . m a c = C . m a c ) then h o s t _ i n f o ⟵ C n . S i p return h o s t _ i n f o


## 4.1. Collection of Network Traffic

Port mirroring is configured to the backbone switch for the collection of real-time network traffic. Port mirroring is set up to collect all of the traffic routed from the backbone switch to analyze the attribute information. Figure10 presents a diagram outlining the collection of real-time network traffic.


## 4.2. Extraction of Attribute Information

Attribute information extracted from real-time traffic in the experimental environment presented in Figure10 is stored in the flow log database (FLDB). The FLDB stores the features of the attributes extracted from the traffic headers, both normal and malicious traffic (e.g., Trojans, botnets, etc.) is included.The collection of network traffic collected at the backbone switch is represented as T=t1, ⋯,tn-1,tn, and the traffic attribute information is defined as t=tip,tport,ttime,tmac, ⋯,turl. The size of the attribute information stored in the FLDB is F=∑i=1n1 and is cumulatively calculated if new attribute information is stored in the FLDB. The protocol stack for extracting packet attribute information is shown in Figure 11.Figure 11
Protocol stack for feature vector extraction.


## 4.3. Attack Pattern Chain (APChain) Creation

TheAPChain algorithm configures a chain of traffic attribute information over time. Behavioral profiling usingAPChain is then conducted to detect abnormal behavior. Table 3 shows the algorithm used to configureAPChain using traffic attribute information extracted from the protocol stack (Figure 11).The source IP, source port, destination IP, destination port, access time, andMAC value are extracted from the network traffic, and the URL information from the payload is analyzed to configureAPChain. Additionally, the connection time and connection frequency of traffic that have the same target IP address are calculated and stored withinAPChain.APChain record is 102 Bytes in size, and the same number ofAPChain records is created as the number of transfers inbound to outbound. Figure 12 shows the results ofAPChain creation using attribution information from the collected traffic.Figure 12
Results of the execution of theAPChain algorithm.


## 4.4. Abnormal Behavior Detection Using Behavioral Profiling

In this section, we will review the process and algorithm for behavior profiling usingAPChain and investigate the detection of abnormal behavior using three case studies.


### 4.4.1. C&C Channel Detection [Case Study A]

Hosts are infected with malicious code by malicious code distribution sites, phishing emails, or social networks. Infected hosts attempt to connect to receive an attack command from a C&C server, to update the C&C server list, or to update the binary file. At this time, the C&C channel uses random ports higher than the known ports and configures a channel with at least one C&C server. Therefore, one method to effectively block botnet attacks is to detect the communication channel with the C&C server and eliminate it before the host infected by malicious code can manifest an attack. The hypothesis that we established for C&C channel detection is presented in Table4. C&C channel detection results are verified in the experiments.Table 4
The hypothesis for C&C channel detection.
Hypothesis 1. C&C channel detection  Given an environment: LetT=t1,⋯,tn-1,tn, where t represents the network traffic, and Tn is the traffic currently being analyzed. LetH=h1,⋯,hn-1,hn, where h represents a host infected by malicious code. LetS=s1,⋯,sn-1,sn, where s represents a C&C server. H ⟹ S, the infected host attempts to connect to the C&C server. A host infected with a botnet creates a C&C channel in order to communicate periodically with the C&C server. As a result, the frequency that a host connects to a particular system increases, and if this pattern is repeated often enough, it can be considered to be unusual traffic. At this point, the host and the C&C server receive attack commands or update binary files while repeating the connection requests and responses. Therefore, the set (G) of C&C channels can be formed by detecting and grouping the requests from hosts connecting to the C&C server. G =H1⟹S1, H2⟹S2, ⋯, Hn-1⟹Sn-1, Hn⟹SnThe commands used to trigger communication between the host and the C&C server are included in a botnet, and the communication method for the creation of the C&C channel and connection cycle are configured. Therefore, if we can detect hosts infected by malicious code connecting to a C&C server, then we can block the attack before the actual attack can be manifested.In this paper, the following process is followed to detect a C&C channel between a host infected by a botnet and a C&C server. First, it confirms if the traffic to be analyzed contains an IP address included as part of the whitelist-based false positive elimination process. If the IP address is included on the list, it is categorized as normal traffic, and if not, it is analyzed to determine abnormal behavior. Second, it calculates the frequency (CNTI) of the host connecting to the target system and compares it with the threshold value. If theCNTI value is higher than the threshold value, then it concludes that communications are occurring regularly and moves on to the next step. Third, it compares the connection time interval (RATD) for traffic that has the same target IP address with the average connection time interval calculated every 30 minutes. At this time, the standard deviation of the average connection time interval (SCTTI) is also calculated, and if the connection time interval (RATD) is {ACTTI-SCTTI±θi≤(RATD)≥(ACTTI+SCTTI)±θj}, then the corresponding traffic is suspected to be a C&C channel. Figure 13 displays the distribution of the connection frequencies and connection cycles of traffic suspected to be C&C channels. Finally, if the connection frequency of a bot to a suspected C&C channel exceeds the threshold value, it is categorized as abnormal traffic behavior.Figure 13
Categorization of abnormal traffic behavior suspected of being a C&C channel.Normal packets and abnormal packets can be categorized by analyzing the network traffic collected in the experimental environment shown in Figure10, and traffic suspected as being a C&C channel can be categorized according to the hypothesis defined in Table 4.Figure13 presents the connection frequency between a host and a suspected C&C channel. IfAPChain’sACTTI isA andSCTTI isS withAPChain connection frequency asx, then, for the traffic suspected as being a C&C channel,C is C={x∣∃x,(A-S)±θi≤x≥(A+S)±θj}. Here,ACTTI is used as the reference value for C&C channel detection. A fixed value is not used; it varies according to the connection cycle of the target IP address. Table 5 presents the algorithm used to detect a C&C channel. The proposed algorithm was developed into a prototype, and its performance is verified in the experiment and evaluation sections of this paper.Table 5
C&C channel detection algorithm.
Algorithm 3. C&C channel detection  /∗ T ⟵ set of packets ∗/ /∗ C ⟵ set of APChain fields ∗/  Function Behavioral_Profiling (T): While(not stop condition)do C ⟵ C a l l   F u n c t i o n   A P C h a i n   ( T )  for T   i s   n o t   n u l l do if(C.cnti≥θi)∩(C.cnti≤θj)then ∃ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   a b n o r m a l   t r a f f i c ) if C . r a t d - C . a c t t i ± C . s c t t i   ≤   θ x then ∀ T ( T   i s   a b n o r m a l   t r a f f i c ) a c c V a l   + = 1 if a c c V a l > θ y then ∀ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   a   C & C   c h a n n e l ) if T ∉ I n t e r n a l   W h i t e l i s t   ( T ) then ∀ T ( T   i s   a   C & C   c h a n n e l ) return T   i s   a   C & C   c h a n n e l


### 4.4.2. Pharming Attack Detection [Case Study B]

Pharming attacks target specific individuals or organizations and infect them via spear phishing or malicious code distribution sites. Pharming attacks falsify Windows environment files or DNS addresses, so even if a host infected by pharming were to call a fake site, the intrusion response system would categorize the corresponding traffic as normal. The hypothesis for detecting a pharming attack is shown in Table6.Table 6
Hypothesis for detecting a pharming attack.
Hypothesis 2. Pharming attack detection  Given an environment: LetT=t1,⋯,tn-1,tn, where t represents the network traffic, and Tn is the traffic currently being analyzed. LetH=h1,⋯,hn-1,hn, where h is a host infected with malicious code. LetS=s1,⋯,sn-1,sn, where s is a fake website. H ⟹ S, the infected host connects to the fake website. The user requests a legitimate website, but a host infected with pharming redirects the connection to a fake website. At that time, when requesting the URL of the legitimate website, a connection to a specific destination IP address may be suspected as a pharming attack. Therefore, we analyze requested URLs from hosts and compare them to the IP addresses of destination websites. The set (G) contains hosts that request the same destination IP addresses. G =H1⟹S1, H2⟹S2, ⋯, Hn-1⟹Sn-1, Hn⟹SnThe algorithm to detect a pharming attack proposed in this paper analyzes whether the site that the host connects to is fake or not. For example, when the host attempts to connect to a website with a specific IP address through different domain names, it can be suspected of being a pharming attack. The average time interval of the connection to a fake website isRATD, and the frequency isCNTI. When the threshold isy, traffic suspected as pharming,P,is represented as P={x∣x∈thresholdy,RATD≤x∩CNTI≥x}. Table 7 presents the algorithm used to detect a pharming attack through behavioral profiling.Table 7
Pharming attack detection algorithm.
Algorithm 4. Pharming attack detection  /∗ T ⟵ set of packets ∗/ /∗ C ⟵ set of APChain fields ∗/  Function Behavioral_Profiling (T): while(not stop condition)do C ⟵ C a l l   F u n c t i o n   A P C h a i n   ( T ) forT is not nulldo if C n . D i p = C m . D i p ∩ C a l l   F u n c   n _ g r a m   ( C ) then ∃ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   p h a r m i n g ) a c c V a l + = 1 if a c c V a l ≥ θ i ∩ C . c n t i ≥ θ j ∩ C . r a t d ≥ θ k then /∗ Analysis of connections to websites suspected as pharming and connections to a specific target IP address ∗/ ∀ T ( T   i s   p h a r m i n g ) returnpharming  Function n-gram(C): if n _ g r a m ( C n . u r l ) ∈ C n - m . u r l then /∗ Accuracy is increased using the n-gram algorithm ∗/ return true


### 4.4.3. IP-Spoofing DDoS Botnet Detection [Case Study C]

As advances in network infrastructure and hardware have progressed, the large volume of traffic generated from a small number of systems has become the main threat to the stability of an internal network. In particular, if malicious codes such as Windows or Linux-related DDoS botnets are not detected in time, then large volumes of traffic would be generated on the internal network, and we would face the threat of the entire network shutting down. Therefore, it is imperative to detect and effectively eliminate hosts infected with malicious code. However, it is not easy to detect hosts that manifest IP-spoofing DDoS attacks, and related research is limited. In this paper,APChain is configured, and we propose a method to detect IP-spoofing DDoS botnets through behavioral profiling. To maintain a communication channel with a C&C server, a host infected with an IP-spoofing DDoS botnet attempts to connect and, if successful, moves to a standby state to receive attack commands. If the host receives an attack command from the C&C server, it generates a large volume of dummy packets to send to the attack target destination. At this time, the source IP address of the packet uses a spoofed IP address and dummy data included in the payload and transfers them to the attack target system. The proposed methodology usesAPChain’s connection frequency (CND), connection time interval, and average connection time interval (ACTTI) values to conduct behavioral profiling and detect DDoS attacks. The hypothesis employed to detect IP-spoofing DDoS botnets is shown in Table 8.Table 8
Hypothesis for detecting IP-spoofing DDoS botnets.
Hypothesis  3. IP-spoofing DDoS botnet detection  Given an environment: LetT=t1,⋯,tn-1,tn, where t represents the network traffic, and Tn is the traffic currently being analyzed. LetH=h1,⋯,hn-1,hn, where h is a host infected with malicious code. LetD=d1,⋯,dn-1,dn, where d represents a target system for DDoS attack. H ⟹ D, the infected host executes a DDoS attack on the target system. A host infected with an IP-spoofing DDoS botnet receives an attack command from the C&C server and implements a DDoS attack, and the origin IP address of the host attacking with DDoS is modified. At that time, a DDoS attack can be suspected if the host sends large amounts of traffic to the destination system. Also, an IP-spoofing DDoS botnet can be categorized if a particular host has a different origin IP address but the same MAC address. Therefore, the set (G) consists of hosts that perform IP-spoofing DDoS attacks. G =H1⟹D1, H2⟹D2, ⋯, Hn-1⟹Dn-1, Hn⟹DnThe algorithm proposed to detect IP-spoofing DDoS botnets detects hosts that have different source IP addresses but that have the same MAC address. For example, when the traffic frequency for a host connecting to the target IP address isCNTI and the average connection cycle isACTTI, if the threshold value isy, then the traffic is suspected to be a DDoS attack,D, where D={x∣x∈threshold,CNTI≥θ∩ACTTI≈0}. At this time, if the traffic has different source IP addresses but the same MAC address, it is presumed to be an IP-spoofing DDoS botnet.The method used to detect an infected host is to search for the MAC address suspected to be a spoofed IP address in theMAC field of theAPChain table and to extract the record that was first registered in theAPChain table to confirm the source IP address. It is assumed that the host with the same IP address as the source IP address is a botnet. Table 9 summarizes the IP-spoofing DDoS botnet detection algorithm using behavioral profiling.Table 9
IP-spoofing DDoS botnet detection algorithm.
Algorithm 5. IP-spoofing DDoS botnet detection /∗T ⟵ set of packets ∗/ /∗ C ⟵ set of APChain fields ∗/  Function Behavioral_Profiling (T): while(not stop condition)do C ⟵ Call Function APChain (T) forT is not nulldo if C . c n t i ≥ θ i then if C . r a t d ≅ 0 ∩ ( C . a c t t i ≅ 0 ) then ∃ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   D D o S ) accVal1 += 1 if a c c V a l 1 ≥ θ j then ∀ T ( T   i s   a   D D o S   a t t a c k ) if ( C n . S i p ∈ C n + m . S i p ) ∩ ( C n . m a c ∈ C n + m . m a c ) then ∃ T ( T   i s   I P   s p o o f i n g ) a c c V a l 2 + = 1 if a c c V a l 2 ≥ θ j then ∀ T ( T   i s   a n   I P   s p o o f i n g   D D o S   a t t a c k ) returnCall Function infection_host (Cn.mac,C)  Function infection_host ( C . n . m a c , C ) while(not stop condition)do if ( C n . m a c = C . m a c ) then h o s t _ i n f o ⟵ C n . S i p return h o s t _ i n f o


## 4.4.1. C&C Channel Detection [Case Study A]

Hosts are infected with malicious code by malicious code distribution sites, phishing emails, or social networks. Infected hosts attempt to connect to receive an attack command from a C&C server, to update the C&C server list, or to update the binary file. At this time, the C&C channel uses random ports higher than the known ports and configures a channel with at least one C&C server. Therefore, one method to effectively block botnet attacks is to detect the communication channel with the C&C server and eliminate it before the host infected by malicious code can manifest an attack. The hypothesis that we established for C&C channel detection is presented in Table4. C&C channel detection results are verified in the experiments.Table 4
The hypothesis for C&C channel detection.
Hypothesis 1. C&C channel detection  Given an environment: LetT=t1,⋯,tn-1,tn, where t represents the network traffic, and Tn is the traffic currently being analyzed. LetH=h1,⋯,hn-1,hn, where h represents a host infected by malicious code. LetS=s1,⋯,sn-1,sn, where s represents a C&C server. H ⟹ S, the infected host attempts to connect to the C&C server. A host infected with a botnet creates a C&C channel in order to communicate periodically with the C&C server. As a result, the frequency that a host connects to a particular system increases, and if this pattern is repeated often enough, it can be considered to be unusual traffic. At this point, the host and the C&C server receive attack commands or update binary files while repeating the connection requests and responses. Therefore, the set (G) of C&C channels can be formed by detecting and grouping the requests from hosts connecting to the C&C server. G =H1⟹S1, H2⟹S2, ⋯, Hn-1⟹Sn-1, Hn⟹SnThe commands used to trigger communication between the host and the C&C server are included in a botnet, and the communication method for the creation of the C&C channel and connection cycle are configured. Therefore, if we can detect hosts infected by malicious code connecting to a C&C server, then we can block the attack before the actual attack can be manifested.In this paper, the following process is followed to detect a C&C channel between a host infected by a botnet and a C&C server. First, it confirms if the traffic to be analyzed contains an IP address included as part of the whitelist-based false positive elimination process. If the IP address is included on the list, it is categorized as normal traffic, and if not, it is analyzed to determine abnormal behavior. Second, it calculates the frequency (CNTI) of the host connecting to the target system and compares it with the threshold value. If theCNTI value is higher than the threshold value, then it concludes that communications are occurring regularly and moves on to the next step. Third, it compares the connection time interval (RATD) for traffic that has the same target IP address with the average connection time interval calculated every 30 minutes. At this time, the standard deviation of the average connection time interval (SCTTI) is also calculated, and if the connection time interval (RATD) is {ACTTI-SCTTI±θi≤(RATD)≥(ACTTI+SCTTI)±θj}, then the corresponding traffic is suspected to be a C&C channel. Figure 13 displays the distribution of the connection frequencies and connection cycles of traffic suspected to be C&C channels. Finally, if the connection frequency of a bot to a suspected C&C channel exceeds the threshold value, it is categorized as abnormal traffic behavior.Figure 13
Categorization of abnormal traffic behavior suspected of being a C&C channel.Normal packets and abnormal packets can be categorized by analyzing the network traffic collected in the experimental environment shown in Figure10, and traffic suspected as being a C&C channel can be categorized according to the hypothesis defined in Table 4.Figure13 presents the connection frequency between a host and a suspected C&C channel. IfAPChain’sACTTI isA andSCTTI isS withAPChain connection frequency asx, then, for the traffic suspected as being a C&C channel,C is C={x∣∃x,(A-S)±θi≤x≥(A+S)±θj}. Here,ACTTI is used as the reference value for C&C channel detection. A fixed value is not used; it varies according to the connection cycle of the target IP address. Table 5 presents the algorithm used to detect a C&C channel. The proposed algorithm was developed into a prototype, and its performance is verified in the experiment and evaluation sections of this paper.Table 5
C&C channel detection algorithm.
Algorithm 3. C&C channel detection  /∗ T ⟵ set of packets ∗/ /∗ C ⟵ set of APChain fields ∗/  Function Behavioral_Profiling (T): While(not stop condition)do C ⟵ C a l l   F u n c t i o n   A P C h a i n   ( T )  for T   i s   n o t   n u l l do if(C.cnti≥θi)∩(C.cnti≤θj)then ∃ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   a b n o r m a l   t r a f f i c ) if C . r a t d - C . a c t t i ± C . s c t t i   ≤   θ x then ∀ T ( T   i s   a b n o r m a l   t r a f f i c ) a c c V a l   + = 1 if a c c V a l > θ y then ∀ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   a   C & C   c h a n n e l ) if T ∉ I n t e r n a l   W h i t e l i s t   ( T ) then ∀ T ( T   i s   a   C & C   c h a n n e l ) return T   i s   a   C & C   c h a n n e l


## 4.4.2. Pharming Attack Detection [Case Study B]

Pharming attacks target specific individuals or organizations and infect them via spear phishing or malicious code distribution sites. Pharming attacks falsify Windows environment files or DNS addresses, so even if a host infected by pharming were to call a fake site, the intrusion response system would categorize the corresponding traffic as normal. The hypothesis for detecting a pharming attack is shown in Table6.Table 6
Hypothesis for detecting a pharming attack.
Hypothesis 2. Pharming attack detection  Given an environment: LetT=t1,⋯,tn-1,tn, where t represents the network traffic, and Tn is the traffic currently being analyzed. LetH=h1,⋯,hn-1,hn, where h is a host infected with malicious code. LetS=s1,⋯,sn-1,sn, where s is a fake website. H ⟹ S, the infected host connects to the fake website. The user requests a legitimate website, but a host infected with pharming redirects the connection to a fake website. At that time, when requesting the URL of the legitimate website, a connection to a specific destination IP address may be suspected as a pharming attack. Therefore, we analyze requested URLs from hosts and compare them to the IP addresses of destination websites. The set (G) contains hosts that request the same destination IP addresses. G =H1⟹S1, H2⟹S2, ⋯, Hn-1⟹Sn-1, Hn⟹SnThe algorithm to detect a pharming attack proposed in this paper analyzes whether the site that the host connects to is fake or not. For example, when the host attempts to connect to a website with a specific IP address through different domain names, it can be suspected of being a pharming attack. The average time interval of the connection to a fake website isRATD, and the frequency isCNTI. When the threshold isy, traffic suspected as pharming,P,is represented as P={x∣x∈thresholdy,RATD≤x∩CNTI≥x}. Table 7 presents the algorithm used to detect a pharming attack through behavioral profiling.Table 7
Pharming attack detection algorithm.
Algorithm 4. Pharming attack detection  /∗ T ⟵ set of packets ∗/ /∗ C ⟵ set of APChain fields ∗/  Function Behavioral_Profiling (T): while(not stop condition)do C ⟵ C a l l   F u n c t i o n   A P C h a i n   ( T ) forT is not nulldo if C n . D i p = C m . D i p ∩ C a l l   F u n c   n _ g r a m   ( C ) then ∃ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   p h a r m i n g ) a c c V a l + = 1 if a c c V a l ≥ θ i ∩ C . c n t i ≥ θ j ∩ C . r a t d ≥ θ k then /∗ Analysis of connections to websites suspected as pharming and connections to a specific target IP address ∗/ ∀ T ( T   i s   p h a r m i n g ) returnpharming  Function n-gram(C): if n _ g r a m ( C n . u r l ) ∈ C n - m . u r l then /∗ Accuracy is increased using the n-gram algorithm ∗/ return true


## 4.4.3. IP-Spoofing DDoS Botnet Detection [Case Study C]

As advances in network infrastructure and hardware have progressed, the large volume of traffic generated from a small number of systems has become the main threat to the stability of an internal network. In particular, if malicious codes such as Windows or Linux-related DDoS botnets are not detected in time, then large volumes of traffic would be generated on the internal network, and we would face the threat of the entire network shutting down. Therefore, it is imperative to detect and effectively eliminate hosts infected with malicious code. However, it is not easy to detect hosts that manifest IP-spoofing DDoS attacks, and related research is limited. In this paper,APChain is configured, and we propose a method to detect IP-spoofing DDoS botnets through behavioral profiling. To maintain a communication channel with a C&C server, a host infected with an IP-spoofing DDoS botnet attempts to connect and, if successful, moves to a standby state to receive attack commands. If the host receives an attack command from the C&C server, it generates a large volume of dummy packets to send to the attack target destination. At this time, the source IP address of the packet uses a spoofed IP address and dummy data included in the payload and transfers them to the attack target system. The proposed methodology usesAPChain’s connection frequency (CND), connection time interval, and average connection time interval (ACTTI) values to conduct behavioral profiling and detect DDoS attacks. The hypothesis employed to detect IP-spoofing DDoS botnets is shown in Table 8.Table 8
Hypothesis for detecting IP-spoofing DDoS botnets.
Hypothesis  3. IP-spoofing DDoS botnet detection  Given an environment: LetT=t1,⋯,tn-1,tn, where t represents the network traffic, and Tn is the traffic currently being analyzed. LetH=h1,⋯,hn-1,hn, where h is a host infected with malicious code. LetD=d1,⋯,dn-1,dn, where d represents a target system for DDoS attack. H ⟹ D, the infected host executes a DDoS attack on the target system. A host infected with an IP-spoofing DDoS botnet receives an attack command from the C&C server and implements a DDoS attack, and the origin IP address of the host attacking with DDoS is modified. At that time, a DDoS attack can be suspected if the host sends large amounts of traffic to the destination system. Also, an IP-spoofing DDoS botnet can be categorized if a particular host has a different origin IP address but the same MAC address. Therefore, the set (G) consists of hosts that perform IP-spoofing DDoS attacks. G =H1⟹D1, H2⟹D2, ⋯, Hn-1⟹Dn-1, Hn⟹DnThe algorithm proposed to detect IP-spoofing DDoS botnets detects hosts that have different source IP addresses but that have the same MAC address. For example, when the traffic frequency for a host connecting to the target IP address isCNTI and the average connection cycle isACTTI, if the threshold value isy, then the traffic is suspected to be a DDoS attack,D, where D={x∣x∈threshold,CNTI≥θ∩ACTTI≈0}. At this time, if the traffic has different source IP addresses but the same MAC address, it is presumed to be an IP-spoofing DDoS botnet.The method used to detect an infected host is to search for the MAC address suspected to be a spoofed IP address in theMAC field of theAPChain table and to extract the record that was first registered in theAPChain table to confirm the source IP address. It is assumed that the host with the same IP address as the source IP address is a botnet. Table 9 summarizes the IP-spoofing DDoS botnet detection algorithm using behavioral profiling.Table 9
IP-spoofing DDoS botnet detection algorithm.
Algorithm 5. IP-spoofing DDoS botnet detection /∗T ⟵ set of packets ∗/ /∗ C ⟵ set of APChain fields ∗/  Function Behavioral_Profiling (T): while(not stop condition)do C ⟵ Call Function APChain (T) forT is not nulldo if C . c n t i ≥ θ i then if C . r a t d ≅ 0 ∩ ( C . a c t t i ≅ 0 ) then ∃ T ( T   i s   i n   t h e   c a n d i d a t e   g r o u p   f o r   D D o S ) accVal1 += 1 if a c c V a l 1 ≥ θ j then ∀ T ( T   i s   a   D D o S   a t t a c k ) if ( C n . S i p ∈ C n + m . S i p ) ∩ ( C n . m a c ∈ C n + m . m a c ) then ∃ T ( T   i s   I P   s p o o f i n g ) a c c V a l 2 + = 1 if a c c V a l 2 ≥ θ j then ∀ T ( T   i s   a n   I P   s p o o f i n g   D D o S   a t t a c k ) returnCall Function infection_host (Cn.mac,C)  Function infection_host ( C . n . m a c , C ) while(not stop condition)do if ( C n . m a c = C . m a c ) then h o s t _ i n f o ⟵ C n . S i p return h o s t _ i n f o


## 5. Experimental Evaluation

The test bed was prepared as shown in Figure10, and a prototype was developed to evaluate the performance of the proposed algorithm. Real-time network traffic collected from the test-bed environment and datasets downloaded from the Malware Capture Facility Project (MCFP) were used as data for the experiment. The dataset included botnets that create and utilize C&C channels.In this section, the following four key aspects are covered:(i) Explanation of the datasets used in the experimental environment(ii) Evaluation of the accuracy of the proposed algorithm(iii) Measurement of the performance of the developed prototype(iv) Effectiveness and accuracy of the experimental results


### 5.1. Experimental Environment and Performance

The experimental test environment is divided into a server farm domain, a user domain, and a branch office. Real-time traffic is collected from the server farm domain and the user domain. The intranet bandwidth is 10 Gbps, and the Internet environment bandwidth is 2 Gbps. The experimental environment for performance evaluation is presented in Table10.Table 10
Experimental environment.
Environment Description Servers ≒ 100 active servers in a server farm  Host ≒ 1,500 active hosts in the internal network  Bandwidth 10 Gbps internal network and 2 Gbps external network  Traffic flow ≒ 530 GB of data monthlyThe prototype was implemented in an environment consisting of an Intel i7 8-core CPU, 16 GB of RAM, and an 8 TB HDD with Java used as the programming language.


### 5.2. Test Dataset

The datasets used in the experiment are network traffic collected in real-time from the test-bed environment and traffic representing malicious behavior from the MCFP [23, 24]. The datasets are explained below.Dataset_1 collects traffic in real-time from the experimental environment shown in Figure 10 and analyzes it. The experimental environment comprises 100 servers and 1,500 hosts; the collected data includes network traffic from the server farm and user domains. The dataset stored collected traffic flow for a period of six months, from January 2017 to June 2017. It includes malicious code that corresponds to the attack types specified in the System Model section. The traffic flow consists of 150,000,000 records and is 3.185 TB in size; the characteristics are presented in Table 11.Table 11
Characteristics ofDataset_1.
Environment Description Period of traffic collection From January to June 2017  Number of records ≅ 150,000,000  Collected record size ≅ 3.185 TB  Servers and Hosts ≅ 100 servers, 1,500 hosts  Flow type Botnet, normalThe scenarios used inDataset_1 are summarized in Table 12.Dataset_1 includes header information (source IP, Destination IP, Protocol, etc.), MAC address, and URL of packets extracted from the network traffic. It includes both normal and malicious traffic.Table 12
Dataset_1.
Scenario Capture name Size Threat type S01 KU-Malware-01 2.6 GB Bot  S02 KU-Malware-02 4.3 GB Bot  S03 KU-Malware-03 1.4 GB Bot  S04 KU-Malware-04 412 MB Bot  S05 KU-Malware-05 1.3 GB Pharming  S06 KU-Malware-06 5.4 GB Pharming  S07 KU-Malware-07 354 MB Pharming  S08 KU-Malware-08 4.3 GB DDoS bot  S09 KU-Malware-09 3.8 GB DDoS bot  S10 KU-Malware-10 2.8 GB DDoS botScenarios S01 and S02 are packets installed with malicious code through a backdoor from a seized account in a system located in the DMZ that includes a communications channel with a C&C server. S03 has a web application system (WAS) administrator account set up with initial values. After the system is seized by an attacker, a webshell is uploaded to install malicious code. S04, S05, S06, and S07 are a scenario in which a host connected to a malicious code distribution sites is infected with a malicious code. Scenarios S08, S09, and S10 involve a host infected with malicious code which is maintaining a communication channel with a C&C server and conducting an IP-spoofing DDoS attack [25].Dataset_2 is malicious code traffic distributed by the MCFP [23]. The MCFP is a research project created by the Czech Technical University ATG Group with the objective of capturing, analyzing, and distributing malicious code traffic, and it distributes datasets to assist in the development of various detection methods. The malicious code traffic distributed by the MCFP can be downloaded from its website [1] and includes a PCAP file, netflow file, and readme file. However, because the PCAP file contains personal information, it does not provide all data. The PCAP file used in the experiment targets traffic that contains information about the C&C server. The MFCP dataset used in the experiment is summarized in Table 13.Table 13
Dataset_2.
Scenario Capture name Size Bot S11 CTU-Malware-13 305 MB Murlo  S12 CTU-Malware-42 5.75 GB Neris  S13 CTU-Malware-44 4.78 GB Rbot  S14 CTU-Malware-46 371 MB Virut  S15 CTU-Malware-47 3.05 GB Menti  S16 CTU-Malware-78 6.3 GB Zeus  S17 CTU-Malware-116 317 MB KazyDataset_2 in Table 13 is a Trojan horse that is installed via user e-mail, messenger applications, or reference libraries. Scenarios S12 and S13 are Neris bot and Rbot bot, and scenarios S14 and S15 are Virut bot and Menti bot. The PCAP file used for the analysis contains both normal and botnet traffic and was captured on the main router of the university network.


### 5.3.APChain Creation

The configuration ofAPChain is critical to detecting abnormal behavior and becomes an important factor with regard to detection speed and accuracy.APChain extracts attribute information from real-time traffic, performs additional analysis, and links attribute information over time. Figure 14 shows the time (GT) to generateAPChain records by packet and the size (FS) ofAPChain table.Figure 14
Time and size forAPChain table generation.According to the experimental results in Figure14,APChain algorithm requires a minimum storage capacity of 102 Bytes to 115 Bytes per packet to generateAPChain table, and 100,000 packets require a storage capacity of 10.9 Mbytes. A minimum of 5 milliseconds and maximum of 8 milliseconds are needed to analyze the attribute information of the packets and to generate record ofAPChain table.As a result, if it takes 6 milliseconds overall to generateAPChain record,ACTTI andSCTTI fields account for 3 milliseconds and 2 milliseconds. Therefore, in order to apply the proposed methodology to a real-time network environment, the calculation of theACTTI andSCTTI fields ofAPChain algorithm should be done effectively.


### 5.4. Performance Evaluation

In this section, the proposed algorithm is applied to the attack types defined in the system model in order to detect these attacks and evaluate its performance.


#### 5.4.1. C&C Channel Detection [Case Study A]

Hosts infected by a botnet maintain a communication channel with a C&C server, receiving either an attack command or updating the configuration before the attack is initiated. Therefore, if it were possible to detect the channel between the host infected by malicious code and the C&C server before important information is breached, it would then be possible to detect or block attacks within the lead time needed for attacks to succeed. According to this, the hypothesis used to detect C&C channels is defined in Table4, and the proof for the hypothesis is provided in Table 14. The performance of the proposed algorithm is verified using experiments, the results of which are presented in Table 15.Table 14
Proof for the detection of C&C channels.
Proof 1. Detection of C&C channels  Given an environment, L e t   H = { h 1 , ⋯ , h n - 1 , h n }, where h is a host infected with malware. L e t   S = { s 1 , s 2 , ⋯ , s n - 1 , s n }, where s is a C&C server. If the connection cycle from the host to the destination system satisfies condition (x), then calculate the accumulated count (ac), and if the accumulated count satisfies threshold (θ), then this is defined as a C&C channel. x = ( μ - σ ) ± θ i ≤ R ∩ ( μ + σ ) ± θ j ≥ R (where R is RATD field value of APChain) μ = ∑ i = 1 n = γ ( t i - t i - 1 ) / γ, σ=∑k=1n=γ(tk-μ)2/n ifx=true, then ac=∑k=1n=γ1 (where γ is the record number of APChain) ifac≥θk,true:CommandandControlchannelfalse:normalnetworktraffic At this point, if the host is not communicating with the C&C server, the host is not infected with a botnet. Accordingly, a host infected with a botnet will maintain the C&C channel while periodically connecting to the C&C server. Therefore, a C&C channel can be categorized if false positives are excluded from the set (C) of hosts suspected to be a C&C channel. C={hn,⋯,hm}∩falsepositive∉CTable 15
Experimental results for C&C channel detection.
Scenario Accuracy Precision Recall TP TN FP FN S01 1.0 1.0 1.0 3 431 0 0  S02 0.993 0.5 1.0 4 537 4 0  S03 0.996 0.6 1.0 3 642 2 0  S04 1.0 1.0 1.0 1 102 0 0  S11 1.0 1.0 1.0 1 12 0 0  S12 0.993 0.03 1.0 1 4174 27 0  S13 0.999 0.5 1.0 1 9988 1 0  S14 0.994 0.1 1.0 1 1536 9 0  S15 0.994 0.09 1.0 1 1535 10 0  S16 0.950 0.5 1.0 1 18 1 0  S17 0.922 0.1 1.0 1 94 8 0The datasets used in detecting C&C channels employed the scenarios S01, S02, S03, and S04 in Table12 and S08, S09, S10, S11, S12, S13, and S14 in Table 13. The C&C channel detection algorithm defined in the System Model section was implemented as a prototype to evaluate performance. The goal of the proposed methodology is to detect C&C channels using theAPChain algorithm and behavioral profiling regardless of any changes to the C&C channel’s communication cycle.One of the steps in the life cycle of a botnet attack is the creation of a communication channel with a C&C server. The proposed algorithm analyzes inbound to outbound traffic to configureAPChain, and behavioral profiling is conducted according to the attack type to detect attacks. At this time,APChain’sSGN field is used as a reference value that is applied to configure the same target IP addresses as a group and link them into a chain. According to the experimental results in Table 15, by using the proposed algorithm, the C&C channel’s true positive rate is 1.0 and the false positive rate, which indicates normal network traffic that is classified as a C&C channel, is 0.003.A true positive is when a C&C channel is detected and determined not to be normal traffic and a true negative is when normal traffic is detected and determined not to be a C&C channel. A false positive detects normal traffic as a C&C channel, and a false negative is when a C&C channel is detected as normal traffic. In such instances, the accuracy is 0.996, the precision is 0.225, and the recall is 1.0.Although the detection of the configuration of a communication channel between a host infected by malicious code and a C&C server has been the focus of several studies, including [3, 7, 26], these detection methods may encounter an increase in false positives or false negatives when the C&C channel occurs irregularly. The methodology here proposes theAPChain algorithm to alleviate the existing problems by using connection time intervals, frequencies, and standard deviations to perform behavioral profiling and thus detect abnormal behavior.According to the test results displayed in Table15, accurate detection was made in scenarios S01, S04, and S11 while detection errors occurred in S02, S03, S12, S13, S14, S15, S16, and S17. The detection errors were false positives, in which normal traffic was detected as C&C traffic. The reason why these false positives occurred was because traffic inspecting the service between the host and the external system was present. However, false positives can be categorized as normal traffic through the elimination of whitelist-based false positives (Section 3.4). We thus applied theInternal Whitelist from Section 3.4 to S12, and the false positive rate decreased by 56% from 27 to 15.The experimental results for detecting a C&C channel according to the threshold value are presented in Table16.Table 16
Experimental results for C&C channel detection according to the threshold value.
Category Accuracy Precision Recall FP rate Threshold A (0, 240)x∣0≤ x ≥ 240, x=frequency 0.0156 0.0006 1.0 0.9850  Threshold B (30, 240)x∣30 ≤ x ≥ 240 0.9998 0.8571 1.0 0.0001  Threshold C (30, 720)x∣30 ≤ x ≥ 720 0.9856 0.0428 1.0 0.0143  Threshold D (90, 720)x∣90 ≤ x ≥ 720 0.9854 0.0289 0.6667 0.0143  Threshold E (0, ∞)x∣0 ≤ x ≥ ∞ 0.0006 0.0006 1.0 1.0In Table16, categoryx indicates the frequency of packets suspected of being a C&C channel. When the cumulative frequency resides within the range of the minimum and maximum values of the threshold given in Table 16, the accuracy, precision, recall, and FP rate are calculated. The accuracy for Threshold B (30, 240) is 0.9998, the precision is 0.8571, and the recall is 1.0. The accuracy of Thresholds C (30, 720) and D (90, 720) are similar to that of Threshold B (30, 240), but the recall and precision are lower than Threshold A (0, 240). For Threshold C (30, 720), the accuracy, which represents the accuracy of C&C channel detection, is higher. However, the false positive rate, which indicates the rate at which normal traffic is categorized as a C&C channel, also increases. For Threshold D (90, 720), C&C channels were not accurately detected, resulting in false negatives, and normal traffic was categorized as a C&C channel, causing the false positive rate to also increase. Consequently, the C&C channel detection accuracy was the highest when the conditions for Threshold B were selected; when the conditions for Thresholds C (30, 720) and D (90, 720) were applied, both the false negative and false positive rates increased.Based on the monitoring of the connection cycle and frequency between a host infected by malicious code and a C&C server, it is found that the connection cycle varies and the cumulative connection frequency is linear. Consequently, detecting a C&C channel with the proposed algorithm reduces detection errors while presenting an effective method for detecting attacks.


#### 5.4.2. Pharming Attack Detection [Case Study B]

Pharming attacks either falsify a Domain Name Service (DNS) server address or falsify a DNS cache file; in an attempt to connect to a normal website, users instead are connected to a fake website because of the falsified DNS server. Pharming attacks can be detected by categorizing whether the host is connecting to a normal site or to a fake site. Accordingly, the hypothesis defined in Table6 is used to detect a pharming attack, and the proof of this hypothesis is provided in Table 17. The performance of the proposed algorithm is verified experimentally and the results are presented in Table 18.Table 17
Proof for the detection of a pharming attack.
Proof 2. Pharming attack detection  Given an environment: L e t   H = h 1 , ⋯ , h n - 1 , h n, where h is a host infected by malware. L e t   S = s 1 , s 2 , ⋯ , s n - 1 , s n ,   w h e r e   s   i s   a   w e b   s e r v e r. Calculate the accumulated count if the destination system has the same IP address but different URLs when connecting from the host to the destination system. At this point, if the accumulated count satisfies threshold (θ), then it is defined as a pharming attack. x=(hn.url→Sn)∩(hm.url→Sn) i f   x = t r u e ∩ ( h n . u r l ≠ h m . u r l ), then ac=∑i=1n=γ1 ifac≥θ,true:pharmingattackfalse:normalnetworktraffic At this point, if the URL and IP address requested by the hosts connecting to the destination system are different, then this is considered normal service. However, there are some cases where the hosts infected with pharming request different URLs from the server but they have the same IP address. Therefore, the set (C) consisting of hosts requesting the same IP address but different URLs from the web server can be categorized as being infected with pharming. C = h n , ⋯ , h m, where h is a host infected by pharmingTable 18
Experimental results for pharming attack detection.
Scenario Accuracy Precision Recall TP TN FP FN S05 0.994 0 .6 1.0 3 382 2 0  S06 1.0 1.0 1.0 4 279 0 0  S07 0.996 0.4 1.0 4 1244 5 0The datasets used in the experiment are applied to scenarios S05, S06, and S07 in Table12, and the algorithm defined in Table 7 is implemented as a prototype.APChainfield values,Sip,Sport,Dip,Dport,URL,CND,RATD, andACTTI, are analyzed, and the characteristics of the host infected by pharming are detected through behavioral profiling.To detect a pharming attack, we conduct behavioral profiling whenAPChain’sACTTI value is higher than theRATD value and the connection frequency,CND, increases.In regard to the outbound traffic collected at the backbone switch, the connection traffic from the host to the website is analyzed, and traffic suspected to be exhibiting abnormal behavior is categorized into a candidate group. The characteristics of the pharming attack are analyzed, and behavioral profiling is conducted to detect an attack.According to the experimental results shown in Table18, the ratio for accurately detecting a host infected by a pharming attack connecting to a fake website is 99.6%, with three cases in which a host connecting to a normal website is categorized as a host infected by pharming. To reduce detection errors, URL comparisons are done using n-gram indexing; when the URL address matching accuracy exceeds 80%, the address is categorized as the same URL address. Table 19 shows the detection accuracy rates when n-gram indexing and string matching are used.Table 19
Accuracy comparison between n-gram indexing and string matching.
Condition Accuracy Precision TP Rate FP Rate n-Gram indexing 0.996 0.611 1.0 0.003  String matching 0.84 0.034 1.0 0.160


#### 5.4.3. IP-Spoofing DDoS Botnet Detection [Case Study C]

Hosts infected with malicious code such as the Linux-related Xor.DDoS receive commands from a C&C server to perform an IP-spoofing DDoS botnet attack on target systems in the internal network. Hosts infected with malicious code generate large numbers of falsified source IP addresses and attempt to connect to an external attack system. At this time, even if the internal network firewall detects a large volume of SYN flooding attacks occurring outbound to inbound and closes the port, if the hosts infected by the malicious code cannot be eliminated, the bandwidth will be exhausted by a large volume of packets. Therefore, the proposed methodology can quickly detect DDoS attacks occurring internally and identify and remove hosts that are part of an IP-spoofing DDoS botnet. The proof for the hypothesis used to detect an IP-spoofing DDoS botnet is provided in Table20. The performance of the proposed algorithm is verified experimentally, with the results summarized in Table 21.Table 20
Proof of the detection of an IP-spoofing DDoS botnet.
Proof 3. IP-spoofing DDoS botnet detection  Given an environment: L e t   H = h 1 , ⋯ , h n - 1 , h n, where h is a host infected by malware. L e t   S = s 1 , ⋯ , s n - 1 , s n, where s is a web server. Calculate the accumulated count if the connection cycle from the host to the destination system satisfies condition (x), and it is defined as DDoS if the accumulated count (ac) satisfies threshold (θ). If the IP address of the origin host is modified via forgery, it is detected as an IP-spoofing botnet. x = h n . t i m e - h m . t i m e ≅ 0 ∪ s n . t i m e - s m . t i m e ≅ 0 ifx=true, then ac=∑k=1n=γ1 ifac≥θi,true:DDoSattackfalse:normalnetworktraffic y = ( h n . S i p ≠ h m . S i p ) ∩ ( h n . m a c = h m . m a c ) ify≥θj,true:IPspoofingfalse:normalIP However, if DDoS occurs, the connection cycle is close to 0, and there is a large amount of network traffic. Therefore, calculate the accumulated count threshold (θ) when the traffic occurrence cycle is equal or similar to 0, or when the connection cycle of a particular web server (S) is equal or similar to 0. On this occasion, if it satisfies the condition (ac≥θ), then it is categorized as a DDoS attack. To detect an IP-spoofing DDoS botnet, the set (C) of the hosts with the same MAC address but different origin IP address is categorized as the one infected with a botnet. C = h n , ⋯ , h m, where h is a host infected with an IP-spoofing DDoS botnet.Table 21
Experimental results for IP-spoofing DDoS botnet detection.
Scenario Accuracy Precision Recall TP TN FP FN S08 1.0 1.0 1.0 4 457 0 0  S09 1.0 1.0 1.0 3 526 0 0  S10 1.0 1.0 1.0 3 1065 0 0Scenarios S08, S09, and S10 were used from the experimental dataset for the detection of IP-spoofing DDoS botnets and the prototype algorithm was implemented for the experiment.For the outbound traffic collected from the backbone switch, the traffic that leads to the DDoS attack on the host is analyzed and the traffic suspected of abnormal behavior is categorized as part of the candidate group. We linkAPChain records over time and conduct behavioral profiling to detect IP-spoofing DDoS botnet. At this time, if a DDoS attack is detected, theSip andMAC fields ofAPChain are analyzed to find the host infected with the IP-spoofing DDoS botnet.A true positive is the detection of an IP-spoofing DDoS botnet and a true negative is the detection of normal traffic. A false positive is erroneously detecting normal traffic as an IP-spoofing DDoS botnet and a false negative is erroneously detecting an IP-spoofing DDoS botnet as normal traffic. As shown in Table21, the detection of IP-spoofing DDoS botnets shows an accuracy and precision rate of 1.0 for scenarios S08, S09, and S10.According to the experimental results, the host infected with malicious Xor.DDoS code generates more than one million SYN flooding packets per minute and transmits about 64 GB of dummy traffic to the network.


### 5.5. Performance Ability

In this section, we measure the detection time for the three types of attack. The datasets used in the experiment are defined in Tables12 and 13.Figure15(a) shows that S01 is the scenario in which the most time is used to detect a C&C channel; the C&C channel and the infected host were detected within an average time of 43 minutes. In S03, it takes an average of 13 minutes to detect the C&C channel in the infected host. Based on these results, it is possible to detect the C&C channel within the lead time, after which the host can be infected with malicious code and threatened.Figure 15
Measurement of case study detection times.
(a)
C&C channel detection (b)
Pharming detection (c)
IP-spoofing DDoS detectionIn Figure15(b), the time between the host that has been infected with malicious code connecting to the fake site and detecting the pharming attack is 31 minutes on average for S05. For S06, it takes 42 minutes on average to detect the pharming attack because the time interval for the host to call the fake site is large. The experiment indicates that, when the host infected by a pharming attack connects to a fake site, detection is possible with the proposed algorithm and, because the IP address of the target website can be changed, detection accuracy increases when abnormal behavior is detected more than three times.According to Figure15(c), when a host infected with malicious code develops a DDoS attack, the generated outbound traffic rapidly increases and the bandwidth of the internal network is exhausted. In S08, the detection of a DDoS attack is detected within 9 seconds, and IP-spoofing is detected within 60 seconds. In the test results for scenario S09, a DDoS attack is detected when the host's malicious code produces a large amount of traffic, and IP-spoofing was detected within 75 seconds. The proposed methodology thus exhibits a DDoS attack detection performance similar to that of an intrusion detection system, and it is able to effectively detect a host infected with IP-spoofing.In order to apply the proposed approach to a large-scale network environment, it is necessary to efficiently implementAPChain algorithm and ensure sufficient hardware performance to process a large number of packets. For example, approximately 3.4% of the IP packets collected in al real-time network are TCP traffic [27], and packets collected in the experimental environment of Section 5.1 process traffic of up to 100 TCPs per second. The proposed algorithm can be applied to a real-time network environment, because it requires 7 milliseconds per packet to generate one record ofAPChain table.In this paper, we exclude known communications that are to send and receive messages by the protocols defined by the FTP or Socket program to increase detection performance and minimize resource consumption. Predefined known communication is registered and managed in theWhitelist in Section 3.4.


## 5.1. Experimental Environment and Performance

The experimental test environment is divided into a server farm domain, a user domain, and a branch office. Real-time traffic is collected from the server farm domain and the user domain. The intranet bandwidth is 10 Gbps, and the Internet environment bandwidth is 2 Gbps. The experimental environment for performance evaluation is presented in Table10.Table 10
Experimental environment.
Environment Description Servers ≒ 100 active servers in a server farm  Host ≒ 1,500 active hosts in the internal network  Bandwidth 10 Gbps internal network and 2 Gbps external network  Traffic flow ≒ 530 GB of data monthlyThe prototype was implemented in an environment consisting of an Intel i7 8-core CPU, 16 GB of RAM, and an 8 TB HDD with Java used as the programming language.


## 5.2. Test Dataset

The datasets used in the experiment are network traffic collected in real-time from the test-bed environment and traffic representing malicious behavior from the MCFP [23, 24]. The datasets are explained below.Dataset_1 collects traffic in real-time from the experimental environment shown in Figure 10 and analyzes it. The experimental environment comprises 100 servers and 1,500 hosts; the collected data includes network traffic from the server farm and user domains. The dataset stored collected traffic flow for a period of six months, from January 2017 to June 2017. It includes malicious code that corresponds to the attack types specified in the System Model section. The traffic flow consists of 150,000,000 records and is 3.185 TB in size; the characteristics are presented in Table 11.Table 11
Characteristics ofDataset_1.
Environment Description Period of traffic collection From January to June 2017  Number of records ≅ 150,000,000  Collected record size ≅ 3.185 TB  Servers and Hosts ≅ 100 servers, 1,500 hosts  Flow type Botnet, normalThe scenarios used inDataset_1 are summarized in Table 12.Dataset_1 includes header information (source IP, Destination IP, Protocol, etc.), MAC address, and URL of packets extracted from the network traffic. It includes both normal and malicious traffic.Table 12
Dataset_1.
Scenario Capture name Size Threat type S01 KU-Malware-01 2.6 GB Bot  S02 KU-Malware-02 4.3 GB Bot  S03 KU-Malware-03 1.4 GB Bot  S04 KU-Malware-04 412 MB Bot  S05 KU-Malware-05 1.3 GB Pharming  S06 KU-Malware-06 5.4 GB Pharming  S07 KU-Malware-07 354 MB Pharming  S08 KU-Malware-08 4.3 GB DDoS bot  S09 KU-Malware-09 3.8 GB DDoS bot  S10 KU-Malware-10 2.8 GB DDoS botScenarios S01 and S02 are packets installed with malicious code through a backdoor from a seized account in a system located in the DMZ that includes a communications channel with a C&C server. S03 has a web application system (WAS) administrator account set up with initial values. After the system is seized by an attacker, a webshell is uploaded to install malicious code. S04, S05, S06, and S07 are a scenario in which a host connected to a malicious code distribution sites is infected with a malicious code. Scenarios S08, S09, and S10 involve a host infected with malicious code which is maintaining a communication channel with a C&C server and conducting an IP-spoofing DDoS attack [25].Dataset_2 is malicious code traffic distributed by the MCFP [23]. The MCFP is a research project created by the Czech Technical University ATG Group with the objective of capturing, analyzing, and distributing malicious code traffic, and it distributes datasets to assist in the development of various detection methods. The malicious code traffic distributed by the MCFP can be downloaded from its website [1] and includes a PCAP file, netflow file, and readme file. However, because the PCAP file contains personal information, it does not provide all data. The PCAP file used in the experiment targets traffic that contains information about the C&C server. The MFCP dataset used in the experiment is summarized in Table 13.Table 13
Dataset_2.
Scenario Capture name Size Bot S11 CTU-Malware-13 305 MB Murlo  S12 CTU-Malware-42 5.75 GB Neris  S13 CTU-Malware-44 4.78 GB Rbot  S14 CTU-Malware-46 371 MB Virut  S15 CTU-Malware-47 3.05 GB Menti  S16 CTU-Malware-78 6.3 GB Zeus  S17 CTU-Malware-116 317 MB KazyDataset_2 in Table 13 is a Trojan horse that is installed via user e-mail, messenger applications, or reference libraries. Scenarios S12 and S13 are Neris bot and Rbot bot, and scenarios S14 and S15 are Virut bot and Menti bot. The PCAP file used for the analysis contains both normal and botnet traffic and was captured on the main router of the university network.


## 5.3.APChain Creation

The configuration ofAPChain is critical to detecting abnormal behavior and becomes an important factor with regard to detection speed and accuracy.APChain extracts attribute information from real-time traffic, performs additional analysis, and links attribute information over time. Figure 14 shows the time (GT) to generateAPChain records by packet and the size (FS) ofAPChain table.Figure 14
Time and size forAPChain table generation.According to the experimental results in Figure14,APChain algorithm requires a minimum storage capacity of 102 Bytes to 115 Bytes per packet to generateAPChain table, and 100,000 packets require a storage capacity of 10.9 Mbytes. A minimum of 5 milliseconds and maximum of 8 milliseconds are needed to analyze the attribute information of the packets and to generate record ofAPChain table.As a result, if it takes 6 milliseconds overall to generateAPChain record,ACTTI andSCTTI fields account for 3 milliseconds and 2 milliseconds. Therefore, in order to apply the proposed methodology to a real-time network environment, the calculation of theACTTI andSCTTI fields ofAPChain algorithm should be done effectively.


## 5.4. Performance Evaluation

In this section, the proposed algorithm is applied to the attack types defined in the system model in order to detect these attacks and evaluate its performance.


### 5.4.1. C&C Channel Detection [Case Study A]

Hosts infected by a botnet maintain a communication channel with a C&C server, receiving either an attack command or updating the configuration before the attack is initiated. Therefore, if it were possible to detect the channel between the host infected by malicious code and the C&C server before important information is breached, it would then be possible to detect or block attacks within the lead time needed for attacks to succeed. According to this, the hypothesis used to detect C&C channels is defined in Table4, and the proof for the hypothesis is provided in Table 14. The performance of the proposed algorithm is verified using experiments, the results of which are presented in Table 15.Table 14
Proof for the detection of C&C channels.
Proof 1. Detection of C&C channels  Given an environment, L e t   H = { h 1 , ⋯ , h n - 1 , h n }, where h is a host infected with malware. L e t   S = { s 1 , s 2 , ⋯ , s n - 1 , s n }, where s is a C&C server. If the connection cycle from the host to the destination system satisfies condition (x), then calculate the accumulated count (ac), and if the accumulated count satisfies threshold (θ), then this is defined as a C&C channel. x = ( μ - σ ) ± θ i ≤ R ∩ ( μ + σ ) ± θ j ≥ R (where R is RATD field value of APChain) μ = ∑ i = 1 n = γ ( t i - t i - 1 ) / γ, σ=∑k=1n=γ(tk-μ)2/n ifx=true, then ac=∑k=1n=γ1 (where γ is the record number of APChain) ifac≥θk,true:CommandandControlchannelfalse:normalnetworktraffic At this point, if the host is not communicating with the C&C server, the host is not infected with a botnet. Accordingly, a host infected with a botnet will maintain the C&C channel while periodically connecting to the C&C server. Therefore, a C&C channel can be categorized if false positives are excluded from the set (C) of hosts suspected to be a C&C channel. C={hn,⋯,hm}∩falsepositive∉CTable 15
Experimental results for C&C channel detection.
Scenario Accuracy Precision Recall TP TN FP FN S01 1.0 1.0 1.0 3 431 0 0  S02 0.993 0.5 1.0 4 537 4 0  S03 0.996 0.6 1.0 3 642 2 0  S04 1.0 1.0 1.0 1 102 0 0  S11 1.0 1.0 1.0 1 12 0 0  S12 0.993 0.03 1.0 1 4174 27 0  S13 0.999 0.5 1.0 1 9988 1 0  S14 0.994 0.1 1.0 1 1536 9 0  S15 0.994 0.09 1.0 1 1535 10 0  S16 0.950 0.5 1.0 1 18 1 0  S17 0.922 0.1 1.0 1 94 8 0The datasets used in detecting C&C channels employed the scenarios S01, S02, S03, and S04 in Table12 and S08, S09, S10, S11, S12, S13, and S14 in Table 13. The C&C channel detection algorithm defined in the System Model section was implemented as a prototype to evaluate performance. The goal of the proposed methodology is to detect C&C channels using theAPChain algorithm and behavioral profiling regardless of any changes to the C&C channel’s communication cycle.One of the steps in the life cycle of a botnet attack is the creation of a communication channel with a C&C server. The proposed algorithm analyzes inbound to outbound traffic to configureAPChain, and behavioral profiling is conducted according to the attack type to detect attacks. At this time,APChain’sSGN field is used as a reference value that is applied to configure the same target IP addresses as a group and link them into a chain. According to the experimental results in Table 15, by using the proposed algorithm, the C&C channel’s true positive rate is 1.0 and the false positive rate, which indicates normal network traffic that is classified as a C&C channel, is 0.003.A true positive is when a C&C channel is detected and determined not to be normal traffic and a true negative is when normal traffic is detected and determined not to be a C&C channel. A false positive detects normal traffic as a C&C channel, and a false negative is when a C&C channel is detected as normal traffic. In such instances, the accuracy is 0.996, the precision is 0.225, and the recall is 1.0.Although the detection of the configuration of a communication channel between a host infected by malicious code and a C&C server has been the focus of several studies, including [3, 7, 26], these detection methods may encounter an increase in false positives or false negatives when the C&C channel occurs irregularly. The methodology here proposes theAPChain algorithm to alleviate the existing problems by using connection time intervals, frequencies, and standard deviations to perform behavioral profiling and thus detect abnormal behavior.According to the test results displayed in Table15, accurate detection was made in scenarios S01, S04, and S11 while detection errors occurred in S02, S03, S12, S13, S14, S15, S16, and S17. The detection errors were false positives, in which normal traffic was detected as C&C traffic. The reason why these false positives occurred was because traffic inspecting the service between the host and the external system was present. However, false positives can be categorized as normal traffic through the elimination of whitelist-based false positives (Section 3.4). We thus applied theInternal Whitelist from Section 3.4 to S12, and the false positive rate decreased by 56% from 27 to 15.The experimental results for detecting a C&C channel according to the threshold value are presented in Table16.Table 16
Experimental results for C&C channel detection according to the threshold value.
Category Accuracy Precision Recall FP rate Threshold A (0, 240)x∣0≤ x ≥ 240, x=frequency 0.0156 0.0006 1.0 0.9850  Threshold B (30, 240)x∣30 ≤ x ≥ 240 0.9998 0.8571 1.0 0.0001  Threshold C (30, 720)x∣30 ≤ x ≥ 720 0.9856 0.0428 1.0 0.0143  Threshold D (90, 720)x∣90 ≤ x ≥ 720 0.9854 0.0289 0.6667 0.0143  Threshold E (0, ∞)x∣0 ≤ x ≥ ∞ 0.0006 0.0006 1.0 1.0In Table16, categoryx indicates the frequency of packets suspected of being a C&C channel. When the cumulative frequency resides within the range of the minimum and maximum values of the threshold given in Table 16, the accuracy, precision, recall, and FP rate are calculated. The accuracy for Threshold B (30, 240) is 0.9998, the precision is 0.8571, and the recall is 1.0. The accuracy of Thresholds C (30, 720) and D (90, 720) are similar to that of Threshold B (30, 240), but the recall and precision are lower than Threshold A (0, 240). For Threshold C (30, 720), the accuracy, which represents the accuracy of C&C channel detection, is higher. However, the false positive rate, which indicates the rate at which normal traffic is categorized as a C&C channel, also increases. For Threshold D (90, 720), C&C channels were not accurately detected, resulting in false negatives, and normal traffic was categorized as a C&C channel, causing the false positive rate to also increase. Consequently, the C&C channel detection accuracy was the highest when the conditions for Threshold B were selected; when the conditions for Thresholds C (30, 720) and D (90, 720) were applied, both the false negative and false positive rates increased.Based on the monitoring of the connection cycle and frequency between a host infected by malicious code and a C&C server, it is found that the connection cycle varies and the cumulative connection frequency is linear. Consequently, detecting a C&C channel with the proposed algorithm reduces detection errors while presenting an effective method for detecting attacks.


### 5.4.2. Pharming Attack Detection [Case Study B]

Pharming attacks either falsify a Domain Name Service (DNS) server address or falsify a DNS cache file; in an attempt to connect to a normal website, users instead are connected to a fake website because of the falsified DNS server. Pharming attacks can be detected by categorizing whether the host is connecting to a normal site or to a fake site. Accordingly, the hypothesis defined in Table6 is used to detect a pharming attack, and the proof of this hypothesis is provided in Table 17. The performance of the proposed algorithm is verified experimentally and the results are presented in Table 18.Table 17
Proof for the detection of a pharming attack.
Proof 2. Pharming attack detection  Given an environment: L e t   H = h 1 , ⋯ , h n - 1 , h n, where h is a host infected by malware. L e t   S = s 1 , s 2 , ⋯ , s n - 1 , s n ,   w h e r e   s   i s   a   w e b   s e r v e r. Calculate the accumulated count if the destination system has the same IP address but different URLs when connecting from the host to the destination system. At this point, if the accumulated count satisfies threshold (θ), then it is defined as a pharming attack. x=(hn.url→Sn)∩(hm.url→Sn) i f   x = t r u e ∩ ( h n . u r l ≠ h m . u r l ), then ac=∑i=1n=γ1 ifac≥θ,true:pharmingattackfalse:normalnetworktraffic At this point, if the URL and IP address requested by the hosts connecting to the destination system are different, then this is considered normal service. However, there are some cases where the hosts infected with pharming request different URLs from the server but they have the same IP address. Therefore, the set (C) consisting of hosts requesting the same IP address but different URLs from the web server can be categorized as being infected with pharming. C = h n , ⋯ , h m, where h is a host infected by pharmingTable 18
Experimental results for pharming attack detection.
Scenario Accuracy Precision Recall TP TN FP FN S05 0.994 0 .6 1.0 3 382 2 0  S06 1.0 1.0 1.0 4 279 0 0  S07 0.996 0.4 1.0 4 1244 5 0The datasets used in the experiment are applied to scenarios S05, S06, and S07 in Table12, and the algorithm defined in Table 7 is implemented as a prototype.APChainfield values,Sip,Sport,Dip,Dport,URL,CND,RATD, andACTTI, are analyzed, and the characteristics of the host infected by pharming are detected through behavioral profiling.To detect a pharming attack, we conduct behavioral profiling whenAPChain’sACTTI value is higher than theRATD value and the connection frequency,CND, increases.In regard to the outbound traffic collected at the backbone switch, the connection traffic from the host to the website is analyzed, and traffic suspected to be exhibiting abnormal behavior is categorized into a candidate group. The characteristics of the pharming attack are analyzed, and behavioral profiling is conducted to detect an attack.According to the experimental results shown in Table18, the ratio for accurately detecting a host infected by a pharming attack connecting to a fake website is 99.6%, with three cases in which a host connecting to a normal website is categorized as a host infected by pharming. To reduce detection errors, URL comparisons are done using n-gram indexing; when the URL address matching accuracy exceeds 80%, the address is categorized as the same URL address. Table 19 shows the detection accuracy rates when n-gram indexing and string matching are used.Table 19
Accuracy comparison between n-gram indexing and string matching.
Condition Accuracy Precision TP Rate FP Rate n-Gram indexing 0.996 0.611 1.0 0.003  String matching 0.84 0.034 1.0 0.160


### 5.4.3. IP-Spoofing DDoS Botnet Detection [Case Study C]

Hosts infected with malicious code such as the Linux-related Xor.DDoS receive commands from a C&C server to perform an IP-spoofing DDoS botnet attack on target systems in the internal network. Hosts infected with malicious code generate large numbers of falsified source IP addresses and attempt to connect to an external attack system. At this time, even if the internal network firewall detects a large volume of SYN flooding attacks occurring outbound to inbound and closes the port, if the hosts infected by the malicious code cannot be eliminated, the bandwidth will be exhausted by a large volume of packets. Therefore, the proposed methodology can quickly detect DDoS attacks occurring internally and identify and remove hosts that are part of an IP-spoofing DDoS botnet. The proof for the hypothesis used to detect an IP-spoofing DDoS botnet is provided in Table20. The performance of the proposed algorithm is verified experimentally, with the results summarized in Table 21.Table 20
Proof of the detection of an IP-spoofing DDoS botnet.
Proof 3. IP-spoofing DDoS botnet detection  Given an environment: L e t   H = h 1 , ⋯ , h n - 1 , h n, where h is a host infected by malware. L e t   S = s 1 , ⋯ , s n - 1 , s n, where s is a web server. Calculate the accumulated count if the connection cycle from the host to the destination system satisfies condition (x), and it is defined as DDoS if the accumulated count (ac) satisfies threshold (θ). If the IP address of the origin host is modified via forgery, it is detected as an IP-spoofing botnet. x = h n . t i m e - h m . t i m e ≅ 0 ∪ s n . t i m e - s m . t i m e ≅ 0 ifx=true, then ac=∑k=1n=γ1 ifac≥θi,true:DDoSattackfalse:normalnetworktraffic y = ( h n . S i p ≠ h m . S i p ) ∩ ( h n . m a c = h m . m a c ) ify≥θj,true:IPspoofingfalse:normalIP However, if DDoS occurs, the connection cycle is close to 0, and there is a large amount of network traffic. Therefore, calculate the accumulated count threshold (θ) when the traffic occurrence cycle is equal or similar to 0, or when the connection cycle of a particular web server (S) is equal or similar to 0. On this occasion, if it satisfies the condition (ac≥θ), then it is categorized as a DDoS attack. To detect an IP-spoofing DDoS botnet, the set (C) of the hosts with the same MAC address but different origin IP address is categorized as the one infected with a botnet. C = h n , ⋯ , h m, where h is a host infected with an IP-spoofing DDoS botnet.Table 21
Experimental results for IP-spoofing DDoS botnet detection.
Scenario Accuracy Precision Recall TP TN FP FN S08 1.0 1.0 1.0 4 457 0 0  S09 1.0 1.0 1.0 3 526 0 0  S10 1.0 1.0 1.0 3 1065 0 0Scenarios S08, S09, and S10 were used from the experimental dataset for the detection of IP-spoofing DDoS botnets and the prototype algorithm was implemented for the experiment.For the outbound traffic collected from the backbone switch, the traffic that leads to the DDoS attack on the host is analyzed and the traffic suspected of abnormal behavior is categorized as part of the candidate group. We linkAPChain records over time and conduct behavioral profiling to detect IP-spoofing DDoS botnet. At this time, if a DDoS attack is detected, theSip andMAC fields ofAPChain are analyzed to find the host infected with the IP-spoofing DDoS botnet.A true positive is the detection of an IP-spoofing DDoS botnet and a true negative is the detection of normal traffic. A false positive is erroneously detecting normal traffic as an IP-spoofing DDoS botnet and a false negative is erroneously detecting an IP-spoofing DDoS botnet as normal traffic. As shown in Table21, the detection of IP-spoofing DDoS botnets shows an accuracy and precision rate of 1.0 for scenarios S08, S09, and S10.According to the experimental results, the host infected with malicious Xor.DDoS code generates more than one million SYN flooding packets per minute and transmits about 64 GB of dummy traffic to the network.


## 5.4.1. C&C Channel Detection [Case Study A]

Hosts infected by a botnet maintain a communication channel with a C&C server, receiving either an attack command or updating the configuration before the attack is initiated. Therefore, if it were possible to detect the channel between the host infected by malicious code and the C&C server before important information is breached, it would then be possible to detect or block attacks within the lead time needed for attacks to succeed. According to this, the hypothesis used to detect C&C channels is defined in Table4, and the proof for the hypothesis is provided in Table 14. The performance of the proposed algorithm is verified using experiments, the results of which are presented in Table 15.Table 14
Proof for the detection of C&C channels.
Proof 1. Detection of C&C channels  Given an environment, L e t   H = { h 1 , ⋯ , h n - 1 , h n }, where h is a host infected with malware. L e t   S = { s 1 , s 2 , ⋯ , s n - 1 , s n }, where s is a C&C server. If the connection cycle from the host to the destination system satisfies condition (x), then calculate the accumulated count (ac), and if the accumulated count satisfies threshold (θ), then this is defined as a C&C channel. x = ( μ - σ ) ± θ i ≤ R ∩ ( μ + σ ) ± θ j ≥ R (where R is RATD field value of APChain) μ = ∑ i = 1 n = γ ( t i - t i - 1 ) / γ, σ=∑k=1n=γ(tk-μ)2/n ifx=true, then ac=∑k=1n=γ1 (where γ is the record number of APChain) ifac≥θk,true:CommandandControlchannelfalse:normalnetworktraffic At this point, if the host is not communicating with the C&C server, the host is not infected with a botnet. Accordingly, a host infected with a botnet will maintain the C&C channel while periodically connecting to the C&C server. Therefore, a C&C channel can be categorized if false positives are excluded from the set (C) of hosts suspected to be a C&C channel. C={hn,⋯,hm}∩falsepositive∉CTable 15
Experimental results for C&C channel detection.
Scenario Accuracy Precision Recall TP TN FP FN S01 1.0 1.0 1.0 3 431 0 0  S02 0.993 0.5 1.0 4 537 4 0  S03 0.996 0.6 1.0 3 642 2 0  S04 1.0 1.0 1.0 1 102 0 0  S11 1.0 1.0 1.0 1 12 0 0  S12 0.993 0.03 1.0 1 4174 27 0  S13 0.999 0.5 1.0 1 9988 1 0  S14 0.994 0.1 1.0 1 1536 9 0  S15 0.994 0.09 1.0 1 1535 10 0  S16 0.950 0.5 1.0 1 18 1 0  S17 0.922 0.1 1.0 1 94 8 0The datasets used in detecting C&C channels employed the scenarios S01, S02, S03, and S04 in Table12 and S08, S09, S10, S11, S12, S13, and S14 in Table 13. The C&C channel detection algorithm defined in the System Model section was implemented as a prototype to evaluate performance. The goal of the proposed methodology is to detect C&C channels using theAPChain algorithm and behavioral profiling regardless of any changes to the C&C channel’s communication cycle.One of the steps in the life cycle of a botnet attack is the creation of a communication channel with a C&C server. The proposed algorithm analyzes inbound to outbound traffic to configureAPChain, and behavioral profiling is conducted according to the attack type to detect attacks. At this time,APChain’sSGN field is used as a reference value that is applied to configure the same target IP addresses as a group and link them into a chain. According to the experimental results in Table 15, by using the proposed algorithm, the C&C channel’s true positive rate is 1.0 and the false positive rate, which indicates normal network traffic that is classified as a C&C channel, is 0.003.A true positive is when a C&C channel is detected and determined not to be normal traffic and a true negative is when normal traffic is detected and determined not to be a C&C channel. A false positive detects normal traffic as a C&C channel, and a false negative is when a C&C channel is detected as normal traffic. In such instances, the accuracy is 0.996, the precision is 0.225, and the recall is 1.0.Although the detection of the configuration of a communication channel between a host infected by malicious code and a C&C server has been the focus of several studies, including [3, 7, 26], these detection methods may encounter an increase in false positives or false negatives when the C&C channel occurs irregularly. The methodology here proposes theAPChain algorithm to alleviate the existing problems by using connection time intervals, frequencies, and standard deviations to perform behavioral profiling and thus detect abnormal behavior.According to the test results displayed in Table15, accurate detection was made in scenarios S01, S04, and S11 while detection errors occurred in S02, S03, S12, S13, S14, S15, S16, and S17. The detection errors were false positives, in which normal traffic was detected as C&C traffic. The reason why these false positives occurred was because traffic inspecting the service between the host and the external system was present. However, false positives can be categorized as normal traffic through the elimination of whitelist-based false positives (Section 3.4). We thus applied theInternal Whitelist from Section 3.4 to S12, and the false positive rate decreased by 56% from 27 to 15.The experimental results for detecting a C&C channel according to the threshold value are presented in Table16.Table 16
Experimental results for C&C channel detection according to the threshold value.
Category Accuracy Precision Recall FP rate Threshold A (0, 240)x∣0≤ x ≥ 240, x=frequency 0.0156 0.0006 1.0 0.9850  Threshold B (30, 240)x∣30 ≤ x ≥ 240 0.9998 0.8571 1.0 0.0001  Threshold C (30, 720)x∣30 ≤ x ≥ 720 0.9856 0.0428 1.0 0.0143  Threshold D (90, 720)x∣90 ≤ x ≥ 720 0.9854 0.0289 0.6667 0.0143  Threshold E (0, ∞)x∣0 ≤ x ≥ ∞ 0.0006 0.0006 1.0 1.0In Table16, categoryx indicates the frequency of packets suspected of being a C&C channel. When the cumulative frequency resides within the range of the minimum and maximum values of the threshold given in Table 16, the accuracy, precision, recall, and FP rate are calculated. The accuracy for Threshold B (30, 240) is 0.9998, the precision is 0.8571, and the recall is 1.0. The accuracy of Thresholds C (30, 720) and D (90, 720) are similar to that of Threshold B (30, 240), but the recall and precision are lower than Threshold A (0, 240). For Threshold C (30, 720), the accuracy, which represents the accuracy of C&C channel detection, is higher. However, the false positive rate, which indicates the rate at which normal traffic is categorized as a C&C channel, also increases. For Threshold D (90, 720), C&C channels were not accurately detected, resulting in false negatives, and normal traffic was categorized as a C&C channel, causing the false positive rate to also increase. Consequently, the C&C channel detection accuracy was the highest when the conditions for Threshold B were selected; when the conditions for Thresholds C (30, 720) and D (90, 720) were applied, both the false negative and false positive rates increased.Based on the monitoring of the connection cycle and frequency between a host infected by malicious code and a C&C server, it is found that the connection cycle varies and the cumulative connection frequency is linear. Consequently, detecting a C&C channel with the proposed algorithm reduces detection errors while presenting an effective method for detecting attacks.


## 5.4.2. Pharming Attack Detection [Case Study B]

Pharming attacks either falsify a Domain Name Service (DNS) server address or falsify a DNS cache file; in an attempt to connect to a normal website, users instead are connected to a fake website because of the falsified DNS server. Pharming attacks can be detected by categorizing whether the host is connecting to a normal site or to a fake site. Accordingly, the hypothesis defined in Table6 is used to detect a pharming attack, and the proof of this hypothesis is provided in Table 17. The performance of the proposed algorithm is verified experimentally and the results are presented in Table 18.Table 17
Proof for the detection of a pharming attack.
Proof 2. Pharming attack detection  Given an environment: L e t   H = h 1 , ⋯ , h n - 1 , h n, where h is a host infected by malware. L e t   S = s 1 , s 2 , ⋯ , s n - 1 , s n ,   w h e r e   s   i s   a   w e b   s e r v e r. Calculate the accumulated count if the destination system has the same IP address but different URLs when connecting from the host to the destination system. At this point, if the accumulated count satisfies threshold (θ), then it is defined as a pharming attack. x=(hn.url→Sn)∩(hm.url→Sn) i f   x = t r u e ∩ ( h n . u r l ≠ h m . u r l ), then ac=∑i=1n=γ1 ifac≥θ,true:pharmingattackfalse:normalnetworktraffic At this point, if the URL and IP address requested by the hosts connecting to the destination system are different, then this is considered normal service. However, there are some cases where the hosts infected with pharming request different URLs from the server but they have the same IP address. Therefore, the set (C) consisting of hosts requesting the same IP address but different URLs from the web server can be categorized as being infected with pharming. C = h n , ⋯ , h m, where h is a host infected by pharmingTable 18
Experimental results for pharming attack detection.
Scenario Accuracy Precision Recall TP TN FP FN S05 0.994 0 .6 1.0 3 382 2 0  S06 1.0 1.0 1.0 4 279 0 0  S07 0.996 0.4 1.0 4 1244 5 0The datasets used in the experiment are applied to scenarios S05, S06, and S07 in Table12, and the algorithm defined in Table 7 is implemented as a prototype.APChainfield values,Sip,Sport,Dip,Dport,URL,CND,RATD, andACTTI, are analyzed, and the characteristics of the host infected by pharming are detected through behavioral profiling.To detect a pharming attack, we conduct behavioral profiling whenAPChain’sACTTI value is higher than theRATD value and the connection frequency,CND, increases.In regard to the outbound traffic collected at the backbone switch, the connection traffic from the host to the website is analyzed, and traffic suspected to be exhibiting abnormal behavior is categorized into a candidate group. The characteristics of the pharming attack are analyzed, and behavioral profiling is conducted to detect an attack.According to the experimental results shown in Table18, the ratio for accurately detecting a host infected by a pharming attack connecting to a fake website is 99.6%, with three cases in which a host connecting to a normal website is categorized as a host infected by pharming. To reduce detection errors, URL comparisons are done using n-gram indexing; when the URL address matching accuracy exceeds 80%, the address is categorized as the same URL address. Table 19 shows the detection accuracy rates when n-gram indexing and string matching are used.Table 19
Accuracy comparison between n-gram indexing and string matching.
Condition Accuracy Precision TP Rate FP Rate n-Gram indexing 0.996 0.611 1.0 0.003  String matching 0.84 0.034 1.0 0.160


## 5.4.3. IP-Spoofing DDoS Botnet Detection [Case Study C]

Hosts infected with malicious code such as the Linux-related Xor.DDoS receive commands from a C&C server to perform an IP-spoofing DDoS botnet attack on target systems in the internal network. Hosts infected with malicious code generate large numbers of falsified source IP addresses and attempt to connect to an external attack system. At this time, even if the internal network firewall detects a large volume of SYN flooding attacks occurring outbound to inbound and closes the port, if the hosts infected by the malicious code cannot be eliminated, the bandwidth will be exhausted by a large volume of packets. Therefore, the proposed methodology can quickly detect DDoS attacks occurring internally and identify and remove hosts that are part of an IP-spoofing DDoS botnet. The proof for the hypothesis used to detect an IP-spoofing DDoS botnet is provided in Table20. The performance of the proposed algorithm is verified experimentally, with the results summarized in Table 21.Table 20
Proof of the detection of an IP-spoofing DDoS botnet.
Proof 3. IP-spoofing DDoS botnet detection  Given an environment: L e t   H = h 1 , ⋯ , h n - 1 , h n, where h is a host infected by malware. L e t   S = s 1 , ⋯ , s n - 1 , s n, where s is a web server. Calculate the accumulated count if the connection cycle from the host to the destination system satisfies condition (x), and it is defined as DDoS if the accumulated count (ac) satisfies threshold (θ). If the IP address of the origin host is modified via forgery, it is detected as an IP-spoofing botnet. x = h n . t i m e - h m . t i m e ≅ 0 ∪ s n . t i m e - s m . t i m e ≅ 0 ifx=true, then ac=∑k=1n=γ1 ifac≥θi,true:DDoSattackfalse:normalnetworktraffic y = ( h n . S i p ≠ h m . S i p ) ∩ ( h n . m a c = h m . m a c ) ify≥θj,true:IPspoofingfalse:normalIP However, if DDoS occurs, the connection cycle is close to 0, and there is a large amount of network traffic. Therefore, calculate the accumulated count threshold (θ) when the traffic occurrence cycle is equal or similar to 0, or when the connection cycle of a particular web server (S) is equal or similar to 0. On this occasion, if it satisfies the condition (ac≥θ), then it is categorized as a DDoS attack. To detect an IP-spoofing DDoS botnet, the set (C) of the hosts with the same MAC address but different origin IP address is categorized as the one infected with a botnet. C = h n , ⋯ , h m, where h is a host infected with an IP-spoofing DDoS botnet.Table 21
Experimental results for IP-spoofing DDoS botnet detection.
Scenario Accuracy Precision Recall TP TN FP FN S08 1.0 1.0 1.0 4 457 0 0  S09 1.0 1.0 1.0 3 526 0 0  S10 1.0 1.0 1.0 3 1065 0 0Scenarios S08, S09, and S10 were used from the experimental dataset for the detection of IP-spoofing DDoS botnets and the prototype algorithm was implemented for the experiment.For the outbound traffic collected from the backbone switch, the traffic that leads to the DDoS attack on the host is analyzed and the traffic suspected of abnormal behavior is categorized as part of the candidate group. We linkAPChain records over time and conduct behavioral profiling to detect IP-spoofing DDoS botnet. At this time, if a DDoS attack is detected, theSip andMAC fields ofAPChain are analyzed to find the host infected with the IP-spoofing DDoS botnet.A true positive is the detection of an IP-spoofing DDoS botnet and a true negative is the detection of normal traffic. A false positive is erroneously detecting normal traffic as an IP-spoofing DDoS botnet and a false negative is erroneously detecting an IP-spoofing DDoS botnet as normal traffic. As shown in Table21, the detection of IP-spoofing DDoS botnets shows an accuracy and precision rate of 1.0 for scenarios S08, S09, and S10.According to the experimental results, the host infected with malicious Xor.DDoS code generates more than one million SYN flooding packets per minute and transmits about 64 GB of dummy traffic to the network.


## 5.5. Performance Ability

In this section, we measure the detection time for the three types of attack. The datasets used in the experiment are defined in Tables12 and 13.Figure15(a) shows that S01 is the scenario in which the most time is used to detect a C&C channel; the C&C channel and the infected host were detected within an average time of 43 minutes. In S03, it takes an average of 13 minutes to detect the C&C channel in the infected host. Based on these results, it is possible to detect the C&C channel within the lead time, after which the host can be infected with malicious code and threatened.Figure 15
Measurement of case study detection times.
(a)
C&C channel detection (b)
Pharming detection (c)
IP-spoofing DDoS detectionIn Figure15(b), the time between the host that has been infected with malicious code connecting to the fake site and detecting the pharming attack is 31 minutes on average for S05. For S06, it takes 42 minutes on average to detect the pharming attack because the time interval for the host to call the fake site is large. The experiment indicates that, when the host infected by a pharming attack connects to a fake site, detection is possible with the proposed algorithm and, because the IP address of the target website can be changed, detection accuracy increases when abnormal behavior is detected more than three times.According to Figure15(c), when a host infected with malicious code develops a DDoS attack, the generated outbound traffic rapidly increases and the bandwidth of the internal network is exhausted. In S08, the detection of a DDoS attack is detected within 9 seconds, and IP-spoofing is detected within 60 seconds. In the test results for scenario S09, a DDoS attack is detected when the host's malicious code produces a large amount of traffic, and IP-spoofing was detected within 75 seconds. The proposed methodology thus exhibits a DDoS attack detection performance similar to that of an intrusion detection system, and it is able to effectively detect a host infected with IP-spoofing.In order to apply the proposed approach to a large-scale network environment, it is necessary to efficiently implementAPChain algorithm and ensure sufficient hardware performance to process a large number of packets. For example, approximately 3.4% of the IP packets collected in al real-time network are TCP traffic [27], and packets collected in the experimental environment of Section 5.1 process traffic of up to 100 TCPs per second. The proposed algorithm can be applied to a real-time network environment, because it requires 7 milliseconds per packet to generate one record ofAPChain table.In this paper, we exclude known communications that are to send and receive messages by the protocols defined by the FTP or Socket program to increase detection performance and minimize resource consumption. Predefined known communication is registered and managed in theWhitelist in Section 3.4.


## 6. Conclusion and Future Work

Botnets are still a serious threat when it comes to cyber-attacks, and attacks on specifically targeted systems go beyond simple hacking. Attackers are employing a variety of attack methods that utilize, for example, malicious code, software vulnerabilities, and social engineering techniques and, by introducing new attack techniques that bypass security systems, they are making it difficult to detect attacks on existing systems.Because signature-based detection is not up to the task of deterring new attack techniques, research on abnormal behavior detection through behavior analysis and the detection of malicious code based on virtual sandboxes is underway. However, when traffic volume increases in a large network environment, sandbox-based malicious code detection becomes time consuming and increases resource inefficiency. It is also not easy to detect and respond to attacks when malicious code is obfuscated or when encrypted communication is used with an external attacker. Therefore, it is necessary to minimize the consumption of resources in a large-scale network environment and to construct an environment capable of effective infringement response even when facing encrypted communication.In this study, to detect abnormal behavior, we analyze traffic attribute information, construct an attack pattern chain algorithm (APChain), and conduct behavioral profiling. The configuration ofAPChain analyzes the attribute information of traffic collected in a real-time network environment and stores it in a database. The attribute values stored in theAPChain table are organized into chains according to the passage of time, and abnormal behavior profiling is then used to detect malicious behavior.The performance evaluation of the proposed algorithm is analyzed with respect to three types of botnet attack. First, C&C communication is detected through network-based behavioral profiling, which is essential in the botnet life cycle. The proposed methodology improves the limitations of C&C channel detection through existing behavior analysis, proposes a methodology that can be effectively applied to a large-scale network environment, and detects C&C channels with an accuracy rate of 99.6%.Second, by analyzing a pharming attack’s characteristics, we constructAPChain for real-time traffic and behavioral profiling for abnormal behavior is conducted to detect an attack. Pharming attacks are difficult to detect in traditional security devices because the host sends a connection request to a normal website and receives a service response, which is not easy to detect with an endpoint system such as a vaccine or a zombie PC detection solution. In this paper, the experimental results show pharming attacks are accurately detected using the proposed algorithm.Third, it detects IP-spoofing DDoS botnets and discovers and eliminates hosts that generate IP-spoofing. An IP-spoofing DDoS botnet performs a DDoS attack against a falsified source IP address of the host, and intrusion prevention systems have difficulty blocking the relevant port. If the wrong IP address is blocked, normal service may be disrupted. Therefore, it is important for service continuity to detect and eliminate a host infected with malicious code. In this study, we analyze DDoS attacks by analyzingAPChain field values ​​and categorize hosts infected by malicious code by analyzing theAPChain for the IP-spoofing of the hosts. In the experiment using the proposed algorithm, the DDoS attack was detected within 10 seconds, and the detection of the host infected with the malicious code was possible within 60 seconds.We propose theAPChain algorithm and a behavioral profiling algorithm to overcome the limitations of existing botnet detection techniques. It proposes an effective abnormal behavior detection method that reduces the number of false positives and false negatives while using limited resources and without having to change the configuration of network resources.In the paper, the proposed C&C channel, pharming, and IP-spoofing DDoS botnet detection are based on the network traffic between hosts and botnets. However, more experiments and verification are needed to detect advanced persistent threat (APT) attacks using C&C channel detection. As part of our future work, we will conduct further studies to detect the C&C channels for APT attacks and IoT botnets using the proposed algorithm. For example, IoT devices infected with malicious code through an IoT botnet will communicate with the C&C server to receive an attack command or download a new binary file. At this time, it will be possible to detect the C&C channel using the proposed methodology.



---

*Source: 9706706-2018-09-04.xml*