Grant: Strategic Projects - Group

The recent growth of botnet activity in cyberspace has attracted a significant attention of the research community. In today's Internet, botnets have become one of the biggest security threats, responsible for a large volume of malicious activities from distributed-denial-of-service (DDoS) attacks to spamming and phishing. The latest unprecedented growth of emerging botnets resulted in a number of the proposed techniques aiming to enhance botnet detection and mitigation. However, most of the proposed approaches had very limited success due to the lack of good understanding of botnet phenomenon on one side, and the quickly evolving strategies employed by botmasters on the other. In spite of the fact that the existence of botnet has long been known, the research community is still struggling to answer questions on the nature of the botnets and find the comprehensive solutions. We propose to explore the problem of botnet attacks from two perspectives: the outside view of the botnet that relates to the actual botnet attacks and the inside aspect that often remains hidden and captures the nature of the botnets creation and use. We rely on visualization techniques to guide the process of botnet detection, understanding and mitigation. Specifically, we aim to develop a Hierarchical Network Application-based Framework for an Automatic Discovery, Visualization and Mitigation of Botnets (DVMBot). This framework will present a generic system for botnet detection & mitigation, independent of the botnet structure and the employed C&C protocols. Once deployed, DVMBot framework will provide a probabilistic analysis of botnet presence in the current host/network and the following monitoring of the security status to ensure timely botnet detection and mitigation. The proposed research will yield a new, sound yet practical framework for integrated approach to the botnet problem.