botnet detection

Smartphones are now well integrated with advanced capabilities and technologies such as the Internet. Today, due to the facilities and capabilities and the widespread use of smart mobile devices, mobile security has become a vital issue worldwide. Smartphones are not properly protected compared to computers and computer networks, and users do not consider security updates. Recently, mobile devices and networks have been targeted by one of the most dangerous cyber threats known as botnets. Mobile Bantent An enhanced example of Boutons has the ability to perform malicious operations such as denial of service attacks, data theft, eavesdropping, and more. Bunters use three communication protocols: HTTP, SMS and Bluetooth to communicate with each other; So when users are not connected to the Internet, botnets are able to communicate with each other. In this study, to identify mobile batonet from 14 Android baton families, including 1932 samples of Android mobile devices applications and 4304 samples of safe and secure Android mobile devices applications have been used. Application permissions were extracted for reverse engineering to automatically classify and detect types of botnets, then based on these permissions, each application was converted to an equivalent image using the proposed method. Labeled images were then used to train convolutional neural networks. The results of evaluation and comparison of this method with classical methods including backup vector machine and decision tree showed that the proposed method is able to achieve higher efficiency in detecting different types of botnets and separating it from healthy programs

A Botnet is a set of infected computers and smart devices on the Internet that are controlled remotely by a Botmaster to perform various malicious activities like distributed denial of service attacks(DDoS), sending spam, click-fraud and etc. When a Botmaster communicates with its own Bots, it generates traffic that  analyzing this traffic to detect the traffic of the Botnet can be one of the influential factors for intrusion  detection systems (IDS). In this paper, the long short term memory (LSTM) method is proposed to classify P2P Botnet activities. The proposed approach is based on the characteristics of the transfer control protocol (TCP) packets and the performance of the method is evaluated using both ISCX and ISOT datasets. The experimental results show that our proposed approach has a high capability in identifying P2P network activities based on evaluation criteria. The proposed method offers a 99.65% precision rate, a 96.32% accuracy rate and a recall rate of 99.63% with a false positive rate (FPR) of 0.67%.

A BotNet is a collection of Bots that are run separately on infected Computers and respond to commands sent from command and control unit. Nowadays, BotNets are a major challenge in cyberspace . New species of this family of malware abuses the popular social networking sites as command and control channels. In this way, the usual protective systems such as IDS will not be able to identify and deal with BotNets, because the network traffic generated by BotNets is similar to the user traffic system. In this paper, a new method is presented to detect, intercept and deal with BotNets based social networks. In this method, BotNet detection is done based on the system resource monitoring. After tracing, the proposed method intercepts with the BotNet. This interception includes preventing from the command and control server. the proposed method can detect nearly 96% of BotNets and can caus the system to discover 100% of BotNets successfully.

Botnets are the latest types of internet-scale malware in recent years that has been the greatest threats to the web servers. Bot is an infected computer by a malware that are controlled remotely by one or more human factors without the user’s knowledge. This controller agent called “bot master” and sometimes the infected system is called “victim”. Peer to peer botnet is one type of botnets that use peer to peer protocols and detection of this type of botnet is more difficult than other types. Our suggested approach is a new method to detect such botnets. This approach uses network flow analysis and clustering method in data mining to detect peer to peer botnets. This approach is flow-based and compares the similarity between flows and K-Means clustering algorithm and eventually determines that the new traffic is an attack or not. This approach has good performance in detection of botnets in flash crowd traffic and this characteristic is distinction of the suggested algorithm and similar algorithms. Finally, the suggested approach has been tested with different traffic.