Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis

By Leyla Bilge, Davide Balzarotti, William K. Robertson, Engin Kirda, Christopher Krügel. Asia-Pacific Computer Systems Architecture Conference, 2012

311 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/098f2ebd339896a4eafc94495aecd54746fa2504

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection (2016, methodology): “[65] 255 misuse DARPA 1998 Ensemble – Random Forest Gharibian and Ghorbani [63] 19 misuse KDD 1999 Ensemble – Random Forest Bilge et al.[66] 49 anomaly NetFlow Ensemble – Random Forest Zhang et al.”
On the Security of Machine Learning in Malware C&C Detection (2016, background): “Bilge et al. [2012] propose DISCLOSURE, a system for identifying malicious servers from netflow data, extracting features related to flow sizes, client access patterns, and temporal behavior.”
POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting (2019, unknown): “docx D %temp%\[0-9].”
Survey on the Usage of Machine Learning Techniques for Malware Analysis (2017, background): “However, there are surveyed works that rely on benign datasets whose size is bigger than the size of malicious ones [12, 15, 40, 42, 69, 71, 73, 76].”
A Survey of Random Forest Based Methods for Intrusion Detection Systems (2018, background): “Bilge et al. (2012) propose the analysis of network flows (NetFlows) to identify botnet command and control servers in large scale.”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, methodology): “DISCLOSURE [8] presents a set of detection features to identify C&C traffic using NetFlow records.”
Detecting and Preventing Cyber Insider Threats: A Survey (2018, methodology): “The DISCLOURE [105] is designed to detect a wider range of botnets by analysing Netflow data within a typical machine learning framework.”
Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data (2014, background): “synchronized hosts infected by the same malware. In contrast to these, our approach does not require malware samples and can detect a single compromised host contacting the C&C server. DISCLOSURE [8] identiﬁes C&C trafﬁc using features extracted from NetFlow records but incorporates external”