Taeil Lee, Kwanhyun Kim, Jihyun Lee, Suchul Lee, Journal of Internet Computing and Services, Vol. 20, No. 6, pp. 11-20, Dec. 2019
10.7472/jksii.2019.20.6.11, Full Text:  HTML
Keywords: Botnet Detection, Word2vec, clustering, Skip-gram

Abstract

Numerous enterprises, organizations and individual users are exposed to large DDoS (Distributed Denial of Service) attacks. DDoS attacks are performed through a BotNet, which is composed of a number of computers infected with a malware, e.g., zombie PCs and a special computer that controls the zombie PCs within a hierarchical chain of a command system. In order to detect a malware, a malware detection software or a vaccine program must identify the malware signature through an in-depth analysis, and these signatures need to be updated in priori. This is time consuming and costly. In this paper, we propose a botnet detection scheme that does not require a periodic signature update using an artificial neural network model. The proposed scheme exploits Word2Vec and accelerated hierarchical density-based clustering. Botnet detection performance of the proposed method was evaluated using the CTU-13 dataset. The experimental result shows that the detection rate is 99.9%, which outperforms the conventional method.

Statistics
Cite this article