Arman Process Journal (APJ)
Quarterly Journal of Information and Communication Technology ​

Analysis of Failed DNS Responses Using Neural Network in Botnet Detection

Document Type : Original Research Article

Authors

Vahid Mohammadi 1
Mohammad Mahdi Shirmohammadi 2

1 Department of Information Technology Management, Hamedan Branch, Islamic Azad University, Hamedan, Iran

2 Department of Computer Engineering, Hamedan Branch, Islamic Azad University, Hamedan, Iran

Abstract
With the increasing development of technology and the expansion of the use of the Internet, botnets are considered as one of the most important security threats in the digital space. Botnets are networks of infected devices controlled by attackers and used for various purposes such as sending spam, DDoS attacks, and stealing sensitive information. Considering the increasing trend of using botnets, it is very important to detect and prevent their activity. The spread of communication, resource sharing, curiosity, earning money, gathering information and gaining resource capacity are motivations for creating botnets. In addition to these, political, economic and military motives should also be added. Our method has the ability to detect known and unknown botnets that use this method. Our goal in this paper is to present an innovative method to detect botnets using failed response analysis and neural network. In this method, botnets are detected based on failed responses or NXDomain in each host. This feature increases the accuracy of detection in small and medium networks. This method has been tested in networks infected with Konfiker and Kraken botnets and the information obtained from it has been analyzed using neural networks. The evaluation results show the good performance of this method in botnet detection.

Keywords

Botnet
Command and Control Server
DNS Traffic
Nxdomain
Neural Network
[1] Maniriho P, Mahmood AN, Chowdhury MJM. Deep Learning Models for Detecting Malware Attacks. 2024.
[2] Kumar D, Reddy S. Effective Botnet Detection with Network Traffic Analysis and AI Techniques. J Netw Comput Appl. 2023.
[3] Singh A, Sharma P. Hybrid Approach for Botnet Detection Using Machine Learning and Statistical Analysis. J Cybersecurity. 2022.
[4]  Reyes Ortiz JL, Roggen D. Anomaly-Based Botnet Detection Using Machine Learning and Flow Analysis. Comput Commun. 2021.
[5]  Kumar A, Kumar P. Automated Botnet Detection with Deep Learning Techniques. J Inf Secur Appl. 2020.
[6] Wang W, Zeng H, Li D. Botnet Detection Based on Traffic Behavior Analysis and Artificial Neural Networks. IEEE Commun Mag. 2010.
[7] Zargari N, Saebi M. Detecting Botnets Using Network Traffic Behavior Analysis and Machine Learning Techniques. J Netw Comput Appl. 2013.
[8] Yadav S, Ganesh AL. A Machine Learning Approach for Botnet Detection in Large-Scale Networks. IEEE Trans Netw Serv Manag. 2015.
[9] Patel HA, Sharma K. Real-Time Botnet Detection Using Machine Learning Techniques. Comput Netw. 2017.
[10]Gupta S, Bhargava B. Detecting Botnets Using a Combined Approach of Network Traffic Analysis and Machine Learning. J Comput Secur. 2018.
[11]Marchetti M, Colajanni M. Botnet Detection Using DNS Traffic Analysis and Machine Learning. IEEE Trans Inf Forensics Secur. 2019.
[12]LeCun Y, Bengio Y, Hinton G. Deep learning. Nature. 2015;521(7553):436-444.
[13]Choi H, Lee H. Identifying botnets by capturing group activities in DNS traffic. 2011.
[14]Choi H, Lee H. Identifying botnets by capturing group activities in DNS traffic. Comput Netw. 2012;56:20-33.
[15]Choi H, et al. BotGAD: detecting botnets by capturing group activities in network traffic. In: Proceedings of the Fourth International ICST Conference on COMmunication System softWAre and middlewaRE; 2009; Dublin, Ireland.
[16]Gu G, et al. BotHunter: Detecting malware infection through ids-driven dialog correlation. In: Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium; 2007; Boston, MA.
[17]Gu G, et al. Botminer: Clustering analysis of network traffic for protocol and structure independent Botnet detection. In: Proceedings of the 17th conference on Security symposium; 2008; San Jose, CA.
[18]Rahbarinia B, et al. Segugio: Efficient Behavior-Based Tracking of Malware-Control Domains in Large ISP Networks. In: NDSS Symposium; 2015.
[19]Alexa Top Global Sites. Available: http://www.alexa.com/topsites.
[20] Schoof R, Koning R. Detecting peer-to-peer botnets. University of Amsterdam, Technical report; 2007.
[21] Skoudis E, et al. Top Ten Cyber Security Menaces for 2008. SANS Institute; 2008.
[22] Cooke E, et al. The zombie roundup: understanding, detecting, and disrupting botnets; 2005.
[23]Park J. Acquiring Digital Evidence from Botnet Attacks: Procedures and Methods; 2011.
[24] Sharifnya R, Abadi M. A novel reputation system to detect DGA-based botnets. In: Computer and Knowledge Engineering (ICCKE), 2013 3th International eConference on; 2013. p. 417-423.
[25]Wireshark. Available: http://www.wireshark.org.
[26]Patel, P., & Modi, C. An Efficient Botnet Detection Framework Using Machine Learning Techniques; 2020.
[27]Lu, Y., Li, Z., & Zhang, C.DNS-based botnet detection using Long Short-Term Memory (LSTM) networks;2019.
[28]Wang, W., Xu, M., Huang, R., & Sun, Z.Botnet Detection Using Machine Learning Techniques; 2018.
[29] Antonakakis M, Perdisci R, Lee W, Vasiloglou N, Dagon D. Detecting Malware Domains at the Upper DNS Hierarchy. USENIX Security Symposium; 2010.
[30]Yu J, Li Z, Yan Q, Han J, Guan X. Network traffic characteristics analysis and anomaly detection on DNS. Comput Netw. 2017;117:87-99.
[31]Bilge L, Kirda E, Kruegel C, Balduzzi M. Exposure: Finding Malicious Domains Using Passive DNS Analysis. NDSS; 2011.
 
 
 
 
 

Home

Submit Manuscript

Reviewers

Contact Us