The Impact of the Observation Period for Detecting P2P Botnets on the Real Traffic Using BotCluster

Chun Yu Wang, Jia Hong Yap, Kuan Chung Chen, Jyh Biau Chang, Ce Kuen Shieh

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

In recent years, many studies on peer-to-peer (P2P) botnet detection have exhibited the excellent detection precision on synthetic logs collected from the testbed. However, most of them do not evaluate their effectiveness on real traffic. In this paper, we use our BotCluster to analyze real traffic from April 2nd to April 15th, 2017, collected as Netflow format, with three time-scopes for detecting P2P botnet activities in two campuses (National Cheng Kung University (NCKU) and National Chung Cheng University (CCU)). Three time-scopes including single-day, three-day, and weekly observation period applied to the same traffic logs for revealing the influence of the observation period on P2P botnet detection. The experiments show that with the weekly observation period, the precision can increase 10% from 84% to 94% on the combined traffic logs of two campuses.

Original languageEnglish
Title of host publicationNew Trends in Computer Technologies and Applications - 23rd International Computer Symposium, ICS 2018, Revised Selected Papers
EditorsChuan-Yu Chang, Chien-Chou Lin, Horng-Horng Lin
PublisherSpringer Verlag
Pages82-92
Number of pages11
ISBN (Print)9789811391897
DOIs
Publication statusPublished - 2019 Jan 1
Event23rd International Computer Symposium, ICS 2018 - Yunlin, Taiwan
Duration: 2018 Dec 202018 Dec 22

Publication series

NameCommunications in Computer and Information Science
Volume1013
ISSN (Print)1865-0929
ISSN (Electronic)1865-0937

Conference

Conference23rd International Computer Symposium, ICS 2018
CountryTaiwan
CityYunlin
Period18-12-2018-12-22

Fingerprint

Traffic
Testbeds
Peer-to-peer (P2P)
Testbed
Observation
Botnet
Evaluate
Experiments
Experiment
Influence

All Science Journal Classification (ASJC) codes

  • Computer Science(all)
  • Mathematics(all)

Cite this

Wang, C. Y., Yap, J. H., Chen, K. C., Chang, J. B., & Shieh, C. K. (2019). The Impact of the Observation Period for Detecting P2P Botnets on the Real Traffic Using BotCluster. In C-Y. Chang, C-C. Lin, & H-H. Lin (Eds.), New Trends in Computer Technologies and Applications - 23rd International Computer Symposium, ICS 2018, Revised Selected Papers (pp. 82-92). (Communications in Computer and Information Science; Vol. 1013). Springer Verlag. https://doi.org/10.1007/978-981-13-9190-3_8
Wang, Chun Yu ; Yap, Jia Hong ; Chen, Kuan Chung ; Chang, Jyh Biau ; Shieh, Ce Kuen. / The Impact of the Observation Period for Detecting P2P Botnets on the Real Traffic Using BotCluster. New Trends in Computer Technologies and Applications - 23rd International Computer Symposium, ICS 2018, Revised Selected Papers. editor / Chuan-Yu Chang ; Chien-Chou Lin ; Horng-Horng Lin. Springer Verlag, 2019. pp. 82-92 (Communications in Computer and Information Science).
@inproceedings{79c627ed73d241ff90f9bc6b13aee595,
title = "The Impact of the Observation Period for Detecting P2P Botnets on the Real Traffic Using BotCluster",
abstract = "In recent years, many studies on peer-to-peer (P2P) botnet detection have exhibited the excellent detection precision on synthetic logs collected from the testbed. However, most of them do not evaluate their effectiveness on real traffic. In this paper, we use our BotCluster to analyze real traffic from April 2nd to April 15th, 2017, collected as Netflow format, with three time-scopes for detecting P2P botnet activities in two campuses (National Cheng Kung University (NCKU) and National Chung Cheng University (CCU)). Three time-scopes including single-day, three-day, and weekly observation period applied to the same traffic logs for revealing the influence of the observation period on P2P botnet detection. The experiments show that with the weekly observation period, the precision can increase 10{\%} from 84{\%} to 94{\%} on the combined traffic logs of two campuses.",
author = "Wang, {Chun Yu} and Yap, {Jia Hong} and Chen, {Kuan Chung} and Chang, {Jyh Biau} and Shieh, {Ce Kuen}",
year = "2019",
month = "1",
day = "1",
doi = "10.1007/978-981-13-9190-3_8",
language = "English",
isbn = "9789811391897",
series = "Communications in Computer and Information Science",
publisher = "Springer Verlag",
pages = "82--92",
editor = "Chuan-Yu Chang and Chien-Chou Lin and Horng-Horng Lin",
booktitle = "New Trends in Computer Technologies and Applications - 23rd International Computer Symposium, ICS 2018, Revised Selected Papers",
address = "Germany",

}

Wang, CY, Yap, JH, Chen, KC, Chang, JB & Shieh, CK 2019, The Impact of the Observation Period for Detecting P2P Botnets on the Real Traffic Using BotCluster. in C-Y Chang, C-C Lin & H-H Lin (eds), New Trends in Computer Technologies and Applications - 23rd International Computer Symposium, ICS 2018, Revised Selected Papers. Communications in Computer and Information Science, vol. 1013, Springer Verlag, pp. 82-92, 23rd International Computer Symposium, ICS 2018, Yunlin, Taiwan, 18-12-20. https://doi.org/10.1007/978-981-13-9190-3_8

The Impact of the Observation Period for Detecting P2P Botnets on the Real Traffic Using BotCluster. / Wang, Chun Yu; Yap, Jia Hong; Chen, Kuan Chung; Chang, Jyh Biau; Shieh, Ce Kuen.

New Trends in Computer Technologies and Applications - 23rd International Computer Symposium, ICS 2018, Revised Selected Papers. ed. / Chuan-Yu Chang; Chien-Chou Lin; Horng-Horng Lin. Springer Verlag, 2019. p. 82-92 (Communications in Computer and Information Science; Vol. 1013).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

TY - GEN

T1 - The Impact of the Observation Period for Detecting P2P Botnets on the Real Traffic Using BotCluster

AU - Wang, Chun Yu

AU - Yap, Jia Hong

AU - Chen, Kuan Chung

AU - Chang, Jyh Biau

AU - Shieh, Ce Kuen

PY - 2019/1/1

Y1 - 2019/1/1

N2 - In recent years, many studies on peer-to-peer (P2P) botnet detection have exhibited the excellent detection precision on synthetic logs collected from the testbed. However, most of them do not evaluate their effectiveness on real traffic. In this paper, we use our BotCluster to analyze real traffic from April 2nd to April 15th, 2017, collected as Netflow format, with three time-scopes for detecting P2P botnet activities in two campuses (National Cheng Kung University (NCKU) and National Chung Cheng University (CCU)). Three time-scopes including single-day, three-day, and weekly observation period applied to the same traffic logs for revealing the influence of the observation period on P2P botnet detection. The experiments show that with the weekly observation period, the precision can increase 10% from 84% to 94% on the combined traffic logs of two campuses.

AB - In recent years, many studies on peer-to-peer (P2P) botnet detection have exhibited the excellent detection precision on synthetic logs collected from the testbed. However, most of them do not evaluate their effectiveness on real traffic. In this paper, we use our BotCluster to analyze real traffic from April 2nd to April 15th, 2017, collected as Netflow format, with three time-scopes for detecting P2P botnet activities in two campuses (National Cheng Kung University (NCKU) and National Chung Cheng University (CCU)). Three time-scopes including single-day, three-day, and weekly observation period applied to the same traffic logs for revealing the influence of the observation period on P2P botnet detection. The experiments show that with the weekly observation period, the precision can increase 10% from 84% to 94% on the combined traffic logs of two campuses.

UR - http://www.scopus.com/inward/record.url?scp=85069669964&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85069669964&partnerID=8YFLogxK

U2 - 10.1007/978-981-13-9190-3_8

DO - 10.1007/978-981-13-9190-3_8

M3 - Conference contribution

AN - SCOPUS:85069669964

SN - 9789811391897

T3 - Communications in Computer and Information Science

SP - 82

EP - 92

BT - New Trends in Computer Technologies and Applications - 23rd International Computer Symposium, ICS 2018, Revised Selected Papers

A2 - Chang, Chuan-Yu

A2 - Lin, Chien-Chou

A2 - Lin, Horng-Horng

PB - Springer Verlag

ER -

Wang CY, Yap JH, Chen KC, Chang JB, Shieh CK. The Impact of the Observation Period for Detecting P2P Botnets on the Real Traffic Using BotCluster. In Chang C-Y, Lin C-C, Lin H-H, editors, New Trends in Computer Technologies and Applications - 23rd International Computer Symposium, ICS 2018, Revised Selected Papers. Springer Verlag. 2019. p. 82-92. (Communications in Computer and Information Science). https://doi.org/10.1007/978-981-13-9190-3_8