An efficient approach to online bot detection based on a reinforcement learning technique

Alauthman, Mohammad (2016) An efficient approach to online bot detection based on a reinforcement learning technique. Doctoral thesis, Northumbria University.

[img]
Preview
Text (Doctoral thesis)
alauthman.mohammad_phd.pdf - Submitted Version

Download (4MB) | Preview

Abstract

In recent years, Botnets have been adopted as a popular method used to carry and spread many malicious codes on the Internet. These codes pave the way to conducting many fraudulent activities, including spam mail, distributed denial of service attacks (DDoS) and click fraud. While many Botnets are set up using a centralized communication architecture such as Internet Relay Chat (IRC) and Hypertext Transfer Protocol (HTTP), peer-to-peer (P2P) Botnets can adopt a decentralized architecture using an overlay network for exchanging command and control (C&C) messages, which is a more resilient and robust communication channel infrastructure. Without a centralized point for C&C servers, P2P Botnets are more flexible to defeat countermeasures and detection procedures than traditional centralized Botnets.

Several Botnet detection techniques have been proposed, but Botnet detection is still a very challenging task for the Internet security community because Botnets execute attacks stealthily in the dramatically growing volumes of network traffic. However, current Botnet detection schemes face significant problem of efficiency and adaptability.

The present study combined a traffic reduction approach with reinforcement learning (RL) method in order to create an online Bot detection system. The proposed framework adopts the idea of RL to improve the system dynamically over time. In addition, the traffic reduction method is used to set up a lightweight and fast online detection method. Moreover, a host feature based on traffic at the connection-level was designed, which can identify Bot host behaviour. Therefore, the proposed technique can potentially be applied to any encrypted network traffic since it depends only on the information obtained from packets header. Therefore, it does not require Deep Packet Inspection (DPI) and cannot be confused with payload encryption techniques.

The network traffic reduction technique reduces packets input to the detection system, but the proposed solution achieves good a detection rate of 98.3% as well as a low false positive rate (FPR) of 0.012% in the online evaluation. Comparison with other techniques on the same dataset shows that our strategy outperforms existing methods. The proposed solution was evaluated and tested using real network traffic datasets to increase the validity of the solution.

Item Type: Thesis (Doctoral)
Uncontrolled Keywords: P2P bot detection, network security, intrusion detection system, network traffic reduction, machine learning
Subjects: G400 Computer Science
Department: Faculties > Engineering and Environment > Computer Science and Digital Technologies
University Services > Research and Business Services > Graduate School > Doctor of Philosophy
Depositing User: Paul Burns
Date Deposited: 09 Feb 2017 17:29
Last Modified: 08 May 2017 13:17
URI: http://nrl.northumbria.ac.uk/id/eprint/29617

Actions (login required)

View Item View Item

Downloads

Downloads per month over past year

View more statistics


Policies: NRL Policies | NRL University Deposit Policy | NRL Deposit Licence