Botnets behavioral patterns in the network. A Machine Learning study of botnet network garcia sebastian
5 likes1,964 views
This document discusses modeling network traffic behaviors to detect botnets. It proposes modeling individual network connections as state sequences based on flow size, duration, and periodicity. Connections are grouped by source/destination IP, port, and protocol. Labeled network data is used to train Markov chain models of normal and botnet connection behaviors. These models are then tested on unlabeled data to detect similar behaviors and identify botnet connections with over 70% accuracy on average. Compared methods achieve lower accuracy rates, showing this behavioral modeling approach is effective for botnet detection.
Botnets behavioral patterns in the network. A Machine Learning study of botnet network garcia sebastian
- 1. Botnets Behavioral Patterns in the Network Garcia Sebastian @eldracote Hack.Lu 2014 CTU University, Czech Republic. UNICEN University, Argentina. October 23, 2014
- 2. How are we detecting malware and botnets? I Analyze the binary
- 3. les. I Analyze the network trac.
- 5. les I Static, Dynamic or Hybrid. I What the malware is capable of doing. Even if it is not doing it, or can't do it now. I How dangerous it is, how complex. I Which techniques it uses. I Behavior inside the host. I Intentions through the capabilities.
- 6. Analyze the network trac I Static or Behavioral. I The actions and how they change. I The actions of all the binaries and modules together. I Real-time updates of binaries and CC servers. I You can see the intentions through the actions. I People doing dynamic analysis of the binary
- 7. les to read the network data may have this information.
- 8. How are we analyzing the Network Trac? From 39 products/companies in the market I 47% use
- 9. ngerprints or rules. I 34% use reputation (TA). I 50% use Anomaly Detection. I Only 2 Machine Learning algorithms where not AD.
- 10. What is working? I Fingerprints are fast. Some are dynamic (e.g. Port Scan) I Fingerprints have few False Positives and can be tuned for your network. I Reputation if fast. Don't need to be tuned so much. I Anomaly Detection... may work for very speci
- 11. c contexts.
- 12. What is not working? I Fingerprints may take days to be created. Most attacks are not covered. I Reputation is case-by-case. Maliciousness is hard to assess. A lot of eort, rules may be short lived. I Anomaly Detection needs to build the normality of each network and adapt. Also, anomaly != maliciousness.
- 13. What is not working? How long does an indicator sit in a Threat Intel feed? Thanks Alex Pinto for the work and image! @alexcpsec. www.mlsecproject.org
- 14. What is not working? How long does an indicator sit in a Threat Intel feed? Thanks Alex Pinto for the work and image! @alexcpsec. www.mlsecproject.org
- 15. What is not working in Machine Learning? I Lack of complete description of the algorithms. I Lack of good, common and labeled datasets. I Lack of good evaluations in real environments. I Lack of good comparisons with other methods. I Results highly depend on the dataset. I Results highly depend on the metrics! I Generalization is very dicult. I There is no algorithm that can perfectly detect all possible virus (Fred Cohen, Computer Viruses: Theory and Experiments, Computers and Security 6 (1987)).
- 16. A dierent approach: Network Behaviors I Instead of anomalies, it tries to model how does a speci
- 17. c trac behaves. I Behavior means to analyze features over time. I But what should be modeled? I Networks? I Hosts? I Servers? I A bot? I A botnet?
- 18. The complexity of network trac is high One bot, 57 days. 3 CC protocols simultaneously (UDP, TCP and HTTP). A long-term analysis show the decisions by the botmaster.
- 19. Our Proposal To deal with the complexity by modeling and
- 20. nding the behavior of individual connections.
- 21. But what is a connection? All the packets related with certain type of action. I The trac to a DNS server (Not all the DNS trac). I The access to https://www.google.com . I The SPAM sent to a speci
- 22. c SMTP server. I The trac to a CC service (server and port). I Etc. I How can we capture these?
- 23. The need for aggregation: 4-tuples If a bot connects every 1 day to a TCP CC server... I TCP-style connections. I One TCP connection is not enough. I At least one NetFlow every day. I One NetFlow does not capture everything. I To get all the connections we need to aggregate NetFlows. I The aggregation structure is called 4-tuple. IT simply aggregates NetFlows by ignoring the source port: I Source IP, destination IP, destination port and protocol.
- 24. The creation of our state-based behavioral model All models are wrong, but some are useful. I We analyze the behavior of each 4-tuple by extracting 3 features of each NetFlow. I Each NetFlow is assigned a state based on these 3 features.
- 25. Features of each State. Keep it Simple. Based on the analysis of long-term CC channels... I The size of the ow. I The duration of the ow. I The periodicity of the ow. But how is periodicity de
- 26. ned?
- 27. Periodicity: 2nd Order Time Dierence (TD) This de
- 28. nition of periodicity allow us accurately analyze connections.
- 29. Behavioral Model: State Assignment to NetFlows I The range of values for each feature is separated with 2 thresholds. I Each NetFlow can be assigned one of 36 states. I The special letter 0 is used for timeout. 2 b B s 3 c C t 4 d D u 5 e E v 6 f F w 7 g G x 8 h H y 9 i I z Not enough data Strongly periodic Weakly periodic Not periodic Small Size Medium Size Big Size Duration Short Medium Long Short Medium Long Short Medium Long 1 a A r
- 30. Behavioral Model: Chain of States I Each 4-tuple receives multiple NetFlows. I Each NetFlow is assigned one state (one letter). I The 4-tuple has a chain of states that models its behavior over time. For example the 4-tuple 147.32.84.165-212.117.171.138-65500-tcp has the following chain of states: 96iIIiF
- 31. iIiiIII
- 36. 0wwwwFf(...) This connection is a TCP-based plain text botnet CC channel.
- 37. Visualization of Behavior. 1st Botnet Connections An example of a botnet with DNS/TCP access for DGA, HTTP, and HTTPS. An example of an HTTP CC channel.
- 38. Visualization of Behavior: 2nd Normal Connections Normal HTTP and DNS.
- 39. Summary of the visualizations I It is important to be able to see and verify the behaviors. Helps evaluating the detection later. I No connection has a perfect frequency periodicity. I The most periodic connections are automatic by the OS by retrying. I More important than the states are the transitions between states.
- 40. What can be done whit this? Our Botnet Detection Model I Based on the behaviors we created a detection model that: 1. Training phase: Trains a Markov Chain from the known and labeled behaviors. 2. Testing phase: Generalizes the trained Markov Chains to detect similarities in unknown trac.
- 41. Botnet Detection Model: Training Phase I Created a labeled dataset. I Manually veri
- 42. ed. I Botnet, Normal and Background labels. I 600GB of data. I 1,471 dierent unique labels (to, from). I Publicly available. (NetFlows all. Pcap only botnet) I Use a Markov Chain to represent the probabilities of the transitions on each chain of states. a b c a 0.1 0.6 0.3 b 0.25 0.05 0.7 c 0.7 0.3 0
- 43. Botnet Detection Model: Training Phase The training model that we store includes: I The Markov Chain Matrix I The probability of generating the original chain of states that generated the matrix (POriginal).
- 44. Botnet Detection Model: Testing phase Use the stored and trained models to detect similar behavior. I For each 4-tuple in the unknown trac: I Generate the chain of states of the unknown 4-tuple (letters). I For each previously trained model: I Compute the probability that the current model generated the unknown chain of states (PUnknown). I Compute the dierence between POriginal and PUnknown. I If this dierence is larger than a certain threshold, discard the model. I If not, retain this model as a candidate. I Select the candidate model with the smallest dierence. I Assign the labels to the NetFlows.
- 45. Botnet Detection Model: Results I We ran the algorithm in the labeled dataset (separated in training/cross-validation/testing). I You need labeled data to obtain metrics. I Results so far: I Average F-Measure: 78% (Best 93%) I Average FPR: 10% (Best 0.2%) I Which were the errors? Some experiments did not have aa good trained model that represented the testing botnet trac.
- 46. Comparison with other methods I The detection model was compared with other 3 detection methods. I Using the same dataset and error metrics. I CAMNEP system, BotHunter system and BClus system.
- 47. Example Results Name tTP tTN tFP tFN TPR TNR FPR FNR Prec Acc ErrR FM1 CCD 87.6 254 14 0 1 0.94 0.05 0 0.86 0.96 0.03 0.92 AllPo 65.5 0 69 0 1 0 1 0 0.4 0.4 0.5 0.65 BClus 30.2 41.3 27.6 35.3 0.4 0.5 0.4 0.5 0.5 0.5 0.4 0.48 Fs1 7.8 66.4 2.5 57.5 0.1 0.9 .0 0.8 0.7 0.5 0.4 0.20 Fs1.5 6.3 67.2 1.7 59.1 0.9 0.9 0.7 0.5 0.4 0.17 Fd1 6.8 54.2 14.6 58.6 0.1 0.7 0.2 0.8 0.3 0.4 0.5 0.15 Fs2 4 67.6 1.3 61.4 0.9 0.9 0.7 0.5 0.4 0.11 Fd1.5 4.6 57.5 11.4 60.8 0.8 0.1 0.9 0.2 0.4 0.5 0.11 Fd2 2.2 59.8 9.1 63.2 0.8 0.1 0.9 0.1 0.4 0.5 0.05 Mi1 2.3 52.3 16.6 63.1 0.7 0.2 0.9 0. 0.4 0.5 0.05 X1 1.7 68.6 0.3 63.6 0.9 0.9 0.8 0.5 0.4 0.05 X1.5 1.5 68.6 0.3 63.9 0.9 0.9 0.8 0.5 0.4 0.04 BH 1.59 73.8 0.18 109 0.01 0.9 0.9 0.8 0.4 0.5 0.02 Mi1.5 1 56.9 12 64.4 0.8 0.1 0.9 0.4 0.5 0.02 Mi2 0.6 63.1 5.8 64.8 0.9 0.9 0.4 0.5 0.01 Le1 0.2 68.1 0.8 65.2 0.9 0.01 0.9 0.2 0.5 0.4 0.007 Ko1 0.1 68.7 0.1 65.3 0.9 0.9 0.4 0.5 0.4 0.004 Ko1.5 0.08 68.9 0.02 65.3 1 0 0.9 0.7 0.5 0.4 0.002 CA1 0.005 68.7 0.2 65.4 0 0.9 1 0.5 0.4 0 T1.5 0.005 68.9 0 65.4 0 1 0 1 1 0.5 0.4 0 T1 0.005 68.9 0 65.4 0 1 0 1 1 0.5 0.4 0
- 48. Future Work: Behavioral IPS I Use veri
- 49. ed behavioral models in real time trac. I The actions are taken depending on the matching model and independently of the IP addresses, ports, domains or payloads: I Block CC behaviors. I Block DoS attacks. I Block certain type of SPAM. I Block malicious P2P, while allowing normal P2P. I Block brute-force attacks while allowing normal logins. I Behavioral models can be as speci
- 50. c as a signature. . They can generalize to similar behaviors.
- 51. Conclusions I How many ows do we need? I Attacking with one ow? I Future research I The analysis of several behaviors together may improve the detection of the IP. I Verify the classi
- 52. cation of more labels. I Behavioral models captures the dynamism. I Behavior is key to long-run detection.
- 53. Thanks! Thanks for staying! @eldracote eldraco@gmail.com Malware Capture Facility Project: http://mcfp.weebly.com/
- 54. Be careful with the metrics... I Metrics highly depend on the dataset and network. I The utility of a model depends on how it is used. I Metrics highly depend on how errors are considered. We use time windows, IP addresses and an aging function. I We consider a TP when an IP address is correctly detected as botnet at least once in the time window. I We consider a TN when an IP address is correctly detected as Normal during the whole time window.
- 55. Resources I An empirical comparison of botnet detection methods. S. Garca, M. Grill, J. Stiborek, A. Zunino. Computers Security Journal. Elsevier.