Semantics based analysis of botnet activity from heterogeneous data sources - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2015

Semantics based analysis of botnet activity from heterogeneous data sources

Résumé

The diversity in network devices, protocols, data sources and probes impose different challenges to uniformly measure and analyse network traffic. Analysing a network means considering distinctive reporting approaches and diverse methods to represent data, measure times or identify nodes. In this work, we tackle these challenges by relying on semantics, taking advantage of the ontologies' ability to map high-level network concepts to concrete information sources of different nature. In particular, we propose a simple architecture to map network concepts to data stored in relational databases. Based on this architecture, we implement a tool that looks for malicious bot activity, studying, from a unique point of view, DNS traffic from PCAP sources, and TCP connections from IPFIX reports. This approach is able to enhance current DNS based botnet detection methods, taking into account additional heterogeneous analysis elements.
Fichier principal
Vignette du fichier
paper-botnet-case-study-TB-publishable.pdf (264.27 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-01162734 , version 1 (11-06-2015)

Identifiants

  • HAL Id : hal-01162734 , version 1

Citer

Santiago Ruano Rincon, Sandrine Vaton, Antoine Beugnard, Serge Garlatti. Semantics based analysis of botnet activity from heterogeneous data sources. IWCMC 2015 : 11th International Wireless Communications & Mobile Computing Conference - TRAC Workshop : Traffic Analysis and Characterization, Aug 2015, Dubrovnik, Croatia. ⟨hal-01162734⟩
515 Consultations
383 Téléchargements

Partager

Gmail Facebook X LinkedIn More