Unsupervised Learning: Using Clustering Algorithms to Detect Peer to Peer Botnet Flows

無監督學習：使用聚類算法檢測P2P殭屍網路流量

安卓雅(Andrea Medina)

指導教授 ： 孫宏民

國立清華大學/電機資訊學院/資訊系統與應用研究所/碩士(2015年)

摘要

針對殭屍網絡感染的戰爭是誰想要感覺安全對妥協主機任何威脅普通用戶和企業轉戰每一天。隨著巨大的和不斷增長的，攻擊者都在創造新的方法，以捕食脆弱的用戶及其設備保持一致。有必要關注什麼熄滅一個網絡和分析單個感染網絡流可以具有在整個網絡的影響。
在本文中，我們將專注於一個特定種類的殭屍網絡的行為，點對點（P2P），它隨著混合動力殭屍網絡是攻擊者之間不斷增長的趨勢，誰廣泛而詳盡尋找新的方法來繞過所有安全牆通過任何可能的手段。主要做法將包括要素之間從網絡流量中提取的行為相比，只能著眼於從P2P應用的流量，包括P2P殭屍網絡。
在本文中，我們將評估潛在的無監督學習有對P2P殭屍網絡，因為這種類型的學習已被證明與分類的未知變量更好的工作。從常見的P2P應用的數據包結合從一些已知的P2P殭屍網絡就像宙斯和的Waledac會被分析和測試惡意流量。這些算法將進行比較，以便確定，在準確性方面，這是確定不同類型的P2P應用，包括殭屍網絡感染網絡流的最佳擬合。

關鍵字

無監督學習 ； P2P殭屍網路

並列摘要

The war against botnet infection is fought every day by common users and enterprises who want to feel safe against any threat of compromise hosts. With the enormous and continuous growth, attackers are consistent in creating new methods to prey on vulnerable users and their devices. It is necessary to pay close attention to what goes out of a network and analyze the impact a single infected network flow may have over the entire network.
In this paper we are going to focus on the behavior of a particular kind of botnet, Peer 2 Peer (P2P), which along with hybrid botnets is a growing trend among attackers, who extensively and exhaustively search for new ways to bypass all security walls by any means possible. The main approach will consist of a behavior comparison among features extracted from network flows, focusing only in the flows from P2P applications including P2P botnets.
In this thesis, we will assess the potential unsupervised learning has against P2P botnets, because this type of learning has proved to work better with unknown variables of classification. The packets from common P2P applications combine with malicious flows from some known P2P botnets like Zeus and Waledac will be analyze and tested. These algorithms will be compared, in order to determine, in terms of accuracy, which is the best fit to identify different types of P2P applications, including the Botnet infected network flows.

並列關鍵字

Botnet ； Peer to peer ； Peer to peer botnet ； P2P ； Network flows

參考文獻

[3] Pijush Barthakur, Manoj Dahal and Mrinal Kanti Ghose, "A Framework for P2P Botnet Detection Using SVM," in International Conference on Cyber-Enabled Distributed Computing and Knowledge Discover, Sanya, 2012.

[26] Mark Hall, Eibe Frank, Geoffrey Holmes, Bernhard Pfahringer, Peter Reutemann, Ian H. Witten, "The WEKA Data Mining Software: An Update," in SIGKDD Explorations, 2009.

[10] Pratik Narang, "PeerShark: flow-clustering and conversation-generation for malicious peer-to-peer traffic identification," EURASIP Journal on Information Security, 2014.

[15] Shmoys Hochbaum, "A best possible heuristic for the k-center problem," in Mathematics of Operations Research, 1985.

[27] Shang-Chiuan Su, "Detecting P2P Botnet in Software Defined Network," Hsinchu, 2015.