.png){kind=icon}
返回
Botnet Detection Based on Anomaly and Community Detection
.png){kind=icon}
OA
AI
DOI：10.1109/TCNS.2016.2532804.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
We introduce a novel two-stage approach for the important cybersecurity problem of detecting the presence of a botnet and identifying the compromised nodes (the bots), ideally before the botnet becomes active. The first stage detects anomalies by leveraging large deviations of an empirical distribution. We propose two approaches to create the empirical distribution: 1) a flow-based approach estimating the histogram of quantized flows and 2) a graph-based approach estimating the degree distribution of node interaction graphs, encompassing both Erdos-Renyi graphs and scale-free graphs. The second stage detects the bots using ideas from social network community detection in a graph that captures correlations of interactions among nodes over time. Community detection is performed by maximizing a modularity measure in this graph. The modularity maximization problem is nonconvex. We propose a convex relaxation, an effective randomization algorithm, and establish sharp bounds on the suboptimality gap. We apply our method to real-world botnet traffic and compare its performance with other methods.
Keyword:
Anomaly detection
botnets
cybersecurity
optimization
random graphs
social networks
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
5
论文数:
1.7K
被引数:
5.8K
机构
引用论文
.png){kind=icon}
分享收藏分享收藏Robust and Distributed Stochastic Localization in Sensor Networks: Theory and Experimental Results
PREAI
分享收藏
查看更多内容