News

 Statistics

Number of Journals34
Number of Issues1,306
Number of Articles9,427
Article View9,189,269
PDF Download5,621,868
Faghihniya, M., Jalaei, R., Shojaee yas, H. (2021). Kavosh: Offering an Analysis Method and the Impact of Normal Network Traffic on Selection and Extraction Based on the Minkowski Distance. Electronic and Cyber Defense, 9(1), 137-147.
M. J. Faghihniya; R. Jalaei; H. Shojaee yas. "Kavosh: Offering an Analysis Method and the Impact of Normal Network Traffic on Selection and Extraction Based on the Minkowski Distance". Electronic and Cyber Defense, 9, 1, 2021, 137-147.
Faghihniya, M., Jalaei, R., Shojaee yas, H. (2021). 'Kavosh: Offering an Analysis Method and the Impact of Normal Network Traffic on Selection and Extraction Based on the Minkowski Distance', Electronic and Cyber Defense, 9(1), pp. 137-147.
Faghihniya, M., Jalaei, R., Shojaee yas, H. Kavosh: Offering an Analysis Method and the Impact of Normal Network Traffic on Selection and Extraction Based on the Minkowski Distance. Electronic and Cyber Defense, 2021; 9(1): 137-147.

Kavosh: Offering an Analysis Method and the Impact of Normal Network Traffic on Selection and Extraction Based on the Minkowski Distance

پدافند الکترونیکی و سایبری
Article 11, Volume 9, Issue 1 - Serial Number 33, April 2021, Pages 137-147    PDF (1.12 M)
Document Type: Original Article
Authors
M. J. Faghihniya1; R. Jalaei* 2; H. Shojaee yas1
1-
2IHU
Receive Date: 10 June 2020,  Revise Date: 19 September 2020,  Accept Date: 26 October 2020 
Abstract
The growing spread of botnet threats and the development of new platforms for deploying botnets such as the Internet of Things urges the need for confrontation. Research in the field of botnet detection based on machine learning methods, shows that these methods have the necessary efficiency for botnet detection. In this paper, normal and botnet traffic are analyzed by the proposed method based on the Minkowski distance vector. The results of the article show that normal traffic flow affects the feature selection and extraction stage by changing the importance of features. This method scores the features based on near bot-bot      behavioral vectors and far bot-normal behavioral vectors. The results of these experiments on ten sets of normal data and three sets of bot data showed that the score of a feature increases or decreases by more than 50% in environments with various normal traffic.
 
Keywords
Botnet; Network Flow; Feature Extraction; Minkowski Distance; Behavioral Distance
References

[1]     N. Milošević, “History of malware,” arXiv preprint arXiv:1302.5392, 2013.##

[2]     R. Jalaei and M R Hasani Ahangar, “A Analytical Survey on Botnet and Detection Methods,” Electronical & Cyber Defence, vol. 4, pp. 25-46, 2017. (In Persian)##

[3]     Cisco, “Netflow ” [Online]Available: https://www.cisco .com/c/en/us/tech/quality-of-service-qos/netflow/ind ex.html, 2020.##

[4]     B. Claise, S. Bryant, G. Sadasivan, S. Leinen, T. Dietz, and B. Trammell, “Specification of the ip flow information export (ipfix) protocol for the exchange of ip traffic flow information (rfc 5101),” Technical report, The Internet Engineering Task Force (IETF), 2008.##

[5]     J. Han, J. Pei, and M. Kamber, “Data mining: concepts and techniques,” Elsevier, 2011.##

[6]     A. H. Lashkari, G. D. Gil, J. E. Keenan, K. F. Mbah, and A. A. Ghorbani, “A survey leading to a new evaluation framework for network-based botnet detection,” in Proceedings of the 2017 the 7th International Conference on Communication and Network Security, pp. 59-66, 2017.##

[7]     B. A. Alahmadi, E. Mariconti, R. Spolaor, G. Stringhini, and I. Martinovic, “BOTection: Bot Detection by Building Markov Chain Models of Bots Network Behavior,” 2019.##

[8]     A. Pektaş and T. Acarman, “Deep learning to detect botnet via network flow summaries,” Neural Computing and Applications, vol. 31, pp. 8021-8033, 2019.##

[9]     S. García, “Identifying, Modeling and Detecting Botnet Behaviors in the Network,” 2014.##

[10]   S. Almutairi, S. Mahfoudh, S. Almutairi, and J. S. Alowibdi, “Hybrid Botnet Detection Based on Host and Network Analysis,” Journal of Computer Networks and Communications, vol. 2020, 2020.##

[11]   I. T. Sherif  Saad, A. A. Ghorbani, Bassam Sayed, D. Zhao, Wei Lu, John and P. H. Felix, “Detecting P2P botnets through network behavior analysis and machine learning,” Presented at the Proceedings of 9th Annual Conference on Privacy, Security and Trust (PST2011), Montreal, Quebec, Canada, 2011.##

[12]   A. Alenazi, I. Traore, K. Ganame, and I. Woungang,  “Holistic Model for HTTP Botnet Detection Based on DNS Traffic Analysis,” in International Conference on Intelligent, Secure, and Dependable Systems in Distributed and Cloud Environments, pp. 1-18, 2017.##

[13]   S. Garcia, “The CTU-13 Dataset. A Labeled Dataset with Botnet, Normal and Background Traffic,” S. Lab, Ed., ed, 2014.##

[14]   E. B. Beigi, H. H. Jazi, N. Stakhanova, and A. A. Ghorbani,  “Towards effective feature selection in machine learning-based botnet detection approaches,” in 2014 IEEE Conference on Communications and Network Security, pp. 247-255, 2014.##

[15]   A. F. A. Kadir, N. Stakhanova, and A. A. Ghorbani,  “Android botnets: What urls are telling us,” in International Conference on Network and System Security, pp. 78-91, 2015.##

[16]   N. Koroniotis, N. Moustafa, E. Sitnikova, and B. Turnbull,  “Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset,” Future Generation Computer Systems, vol. 100, pp. 779-796, 2019.##

[17]   A. Shiravi, H. Shiravi, M. Tavallaee, and A. A. Ghorbani,  “Toward developing a systematic approach to generate benchmark datasets for intrusion detection,” computers & security, vol. 31, pp. 357-374, 2012.##

[18]   A. H. Lashkari, G. D. Gil, J. E. Keenan, K. Mbah, and A. A. Ghorbani, “A survey leading to a new evaluation framework for network-based botnet detection,” in Proceedings of the 2017 the 7th International Conference on Communication and Network Security, pp. 59-66, 2017.##

[19]   G. Chandrashekar and F. Sahin, “A survey on feature selection methods,” Computers & Electrical Engineering, vol. 40, pp. 16-28, 2014.##

[20]   S. García, V. Uhlíř, and M. Rehak, “Identifying and modeling botnet C&C behaviors,” in Proceedings of the 1st International Workshop on Agents and CyberSecurity, 2014.##

[21]   S. Garcia, “Modelling the network behaviour of malware to block malicious patterns. the stratosphere project: a behavioural ips,” Virus Bulletin, pp. 1-8, 2015.##

[22]   D. Acarali, M. Rajarajan, N. Komninos, and I. Herwono,  “Survey of approaches and features for the identification of HTTP-based botnet traffic,” Journal of Network and Computer Applications, vol. 76, pp. 1-15, 2016.##

[23]   F. Iglesias and T. Zseby, “Analysis of network traffic features for anomaly detection,” Machine Learning, vol. 101, pp. 59-84, 2015.##

 

Statistics
Article View: 684
PDF Download: 527