.png){kind=icon}
.png){kind=icon}
Return
BotFlex: A community-driven tool for botnet detection
.png){kind=icon}
PRE
AI
DOI：10.1016/j.jnca.2015.10.002.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Botnets currently pose the most potent threat to the security and integrity of networked systems. In this paper, we present our experiences of designing, implementing and evaluating BotFlex, which (to the best of our knowledge) is the first open-source network-based tool for botnet detection. BotFlex is designed to support extensibility (in detection parameters and decision elements), flexibility (in configuration), an easy-to-use interface, and real-time operation. While the tool is designed for extension and improvement by community inputs, we report very encouraging accuracy and performance results of our first-cut BotFlex implementation. On a 500 GB trace captured at an ISP with ground truth provided by a commercial security company, BotFlex provides TPR and FPR of 94.4% and 6.6%, respectively - comparable with our baseline state-of-the-art BotHunter tool (TPR: 79.6%, FPR: 6.6%). In addition to accuracy, we observe that BotFlex incurs negligible detection delay, while having good throughput (47 K packets/second) and low processing overhead. (C) 2015 Elsevier Ltd. All rights reserved.
Keywords:
Botnet
Network security
Correlation
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
IF:
8
Papers:
3.6K
Citations:
1.1W