BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation

By Guofei Gu, Phillip A. Porras, Vinod Yegneswaran, Martin W. Fong, Wenke Lee. USENIX Security Symposium, 2007

910 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/0718917ab92761ffee9626057b302464e524a141

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

BotGrep: Finding P2P Bots with Structured Graph Analysis (2010, methodology): “However, growing size of botnets, as well as the development of mechanisms that detect centralized command-and-control servers [10, 44, 27, 31, 72, 9, 49, 30, 29, 76], has motivated the design of decentralized peer-to-peer botnets.”
Insights into User Behavior in Dealing with Internet Attacks (2012, background): “We also show that trick banners that are common in file sharing websites and shortened URLs have high success rates of deceiving non-technical users, thus posing a severe security risk.”
CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data (2016, background): “[20], which was able to observe zero false positives in a real deployment.”
Effective and Efficient Malware Detection at the End Host (2009, methodology): “Such models are often manually-crafted signatures loaded into intrusion detection systems [33] or bot detectors [20].”
From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware (2012, background): “Half of them are variants of known (botnet) DGAs, and the other half are brand new DGAs that have never been reported before.”
Your botnet is my botnet: analysis of a botnet takeover (2009, background): “Given the importance of the problem, significant research effort has been invested to gain a better understanding of the botnet phenomenon [8,29], to study the modus operandi of cyber criminals [19,22], and to develop effective mitigation techniques [10, 11 ].”
Outside the Closed World: On Using Machine Learning for Network Intrusion Detection (2010, methodology): “’s “BotHunter” system uses a “statistical payload anomaly detection engine” as one tool among others (Snort signatures, and a typical scan detector), and a final stage correlates the output of all of them [61].”
On the Security of Machine Learning in Malware C&C Detection (2016, methodology): “BotHunter [Gu et al. 2007] is a system for identifying compromised hosts based upon the actions they perform, more speciﬁcally the pattern of infection and initial connection to a C&C server.”
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic (2008, methodology): “For scan activity detection, BotSniffer uses approaches similar to SCADE (Statistical sCan Anomaly Detection Engine) that we have developed for BotHunter [15].”
Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm (2008, methodology): “Furthermore, we present two different ways to disrupt the communication channel between controller and compromised machines in order to mitigate the botnet and evaluate the effectiveness of these mechanisms.”
NICE: Network Intrusion Detection and Countermeasure Selection in Virtual Network Systems (2013, background): “BotHunter [7] detects compromised machines based on the fact that a thorough malware infection process has a number of well-defined stages that allow correlating the intrusion alarms triggered by inbound traffic with resulting outgoing communication patterns.”
FRESCO: Modular Composable Security Services for Software-Defined Networks (2013, methodology): “In addition, the event manager exposes an API that enables event reporting from legacy DPI-based security applications, such as Snort [37] or BotHunter [12].”
Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis (2012, background): “(i) vertical correlation, or detecting command and control (C&C) channels used by botmasters to communicate with each infected machine [17,19,21,29]; and (ii) horizontal correlation, where botnet detection is based upon patterns of crowd behavior exhibited by collections of bots in response to botma”
Tactical Provenance Analysis for Endpoint Detection and Response Systems (2020, methodology): “Existing systems use statistical-, heuristic, and probabilistic-based alert correlation [69], [70], [71], [72], [73] to correlate alerts.”
Differential privacy for collaborative security (2010, background): “Intrusion detection systems (IDS) use extensive logging and data collection to identify anomalous behavior and to verify it as botnet activity [2, 7, 12, 13, 14 , 15, 20, 22, 29].”
A Taxonomy of Botnet Structures (2007, methodology): “BotHunter [20] is a bot detection system using IDS-Driven Dialog Correlation according to defined bot infection dialog model.”