The Impact of the Observation Period for Detecting P2P Botnets on the Real Traffic Using BotCluster

Chun Yu Wang, Jia Hong Yap, Kuan Chung Chen, Jyh Biau Chang, Ce Kuen Shieh

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

In recent years, many studies on peer-to-peer (P2P) botnet detection have exhibited the excellent detection precision on synthetic logs collected from the testbed. However, most of them do not evaluate their effectiveness on real traffic. In this paper, we use our BotCluster to analyze real traffic from April 2nd to April 15th, 2017, collected as Netflow format, with three time-scopes for detecting P2P botnet activities in two campuses (National Cheng Kung University (NCKU) and National Chung Cheng University (CCU)). Three time-scopes including single-day, three-day, and weekly observation period applied to the same traffic logs for revealing the influence of the observation period on P2P botnet detection. The experiments show that with the weekly observation period, the precision can increase 10% from 84% to 94% on the combined traffic logs of two campuses.

Original languageEnglish
Title of host publicationNew Trends in Computer Technologies and Applications - 23rd International Computer Symposium, ICS 2018, Revised Selected Papers
EditorsChuan-Yu Chang, Chien-Chou Lin, Horng-Horng Lin
PublisherSpringer Verlag
Pages82-92
Number of pages11
ISBN (Print)9789811391897
DOIs
Publication statusPublished - 2019 Jan 1
Event23rd International Computer Symposium, ICS 2018 - Yunlin, Taiwan
Duration: 2018 Dec 202018 Dec 22

Publication series

NameCommunications in Computer and Information Science
Volume1013
ISSN (Print)1865-0929
ISSN (Electronic)1865-0937

Conference

Conference23rd International Computer Symposium, ICS 2018
CountryTaiwan
CityYunlin
Period18-12-2018-12-22

All Science Journal Classification (ASJC) codes

  • Computer Science(all)
  • Mathematics(all)

Fingerprint Dive into the research topics of 'The Impact of the Observation Period for Detecting P2P Botnets on the Real Traffic Using BotCluster'. Together they form a unique fingerprint.

Cite this