Title:
Correlation-based Botnet Detection in Enterprise Networks

Simple item page
dc.contributor.advisor Lee, Wenke
dc.contributor.author Gu, Guofei en_US
dc.contributor.committeeMember Ahamad,Mustaque
dc.contributor.committeeMember Feamster, Nick
dc.contributor.committeeMember Giffin, Jonathon
dc.contributor.committeeMember Ji,Chuanyi
dc.contributor.department Computing en_US
dc.date.accessioned 2008-09-17T19:26:39Z
dc.date.available 2008-09-17T19:26:39Z
dc.date.issued 2008-07-07 en_US
dc.description.abstract Most of the attacks and fraudulent activities on the Internet are carried out by malware. In particular, botnets, as state-of-the-art malware, are now considered as the largest threat to Internet security. In this thesis, we focus on addressing the botnet detection problem in an enterprise-like network environment. We present a comprehensive correlation-based framework for multi-perspective botnet detection consisting of detection technologies demonstrated in four complementary systems: BotHunter, BotSniffer, BotMiner, and BotProbe. The common thread of these systems is correlation analysis, i.e., vertical correlation (dialog correlation), horizontal correlation, and cause-effect correlation. All these Bot* systems have been evaluated in live networks and/or real-world network traces. The evaluation results show that they can accurately detect real-world botnets for their desired detection purposes with a very low false positive rate. We find that correlation analysis techniques are of particular value for detecting advanced malware such as botnets. Dialog correlation can be effective as long as malware infections need multiple stages. Horizontal correlation can be effective as long as malware tends to be distributed and coordinated. In addition, active techniques can greatly complement passive approaches, if carefully used. We believe our experience and lessons are of great benefit to future malware detection. en_US
dc.description.degree Ph.D. en_US
dc.identifier.uri http://hdl.handle.net/1853/24634
dc.publisher Georgia Institute of Technology en_US
dc.subject Malware detection en_US
dc.subject Network security en_US
dc.subject Anomaly detection en_US
dc.subject Intrusion detection en_US
dc.subject.lcsh Local area networks (Computer networks)
dc.subject.lcsh Computer networks Security measures
dc.subject.lcsh Computer crimes
dc.subject.lcsh Correlation (Statistics)
dc.title Correlation-based Botnet Detection in Enterprise Networks en_US
dc.type Text
dc.type.genre Dissertation
dspace.entity.type Publication
local.contributor.advisor Lee, Wenke
local.contributor.corporatename College of Computing
relation.isAdvisorOfPublication c2f2a105-702f-45e4-a8a3-4ca5eb3d0eec
relation.isOrgUnitOfPublication c8892b3c-8db6-4b7b-a33a-1b67f7db2021
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
gu_guofei_200808_phd.pdf
Size:
1.11 MB
Format:
Adobe Portable Document Format
Description:
Download
Collections
Theses and Dissertations