Botnet attacks are a major threat to networked systems because of their ability to turn the network nodes that they compromise into additional attackers, leading to the spread of high volume attacks over long periods. The detection of such Botnets is complicated by the fact that multiple network IP addresses will be simultaneously compromised, so that Collective Classification of compromised nodes, in addition to the already available traditional methods that focus on individual nodes, can be useful. Thus this work introduces a collective Botnet attack classification technique that operates on traffic from an n-node IP network with a novel Associated Random Neural Network (ARNN) that identifies the nodes which are compromised. The ARNN is a recurrent architecture that incorporates two mutually associated, interconnected and architecturally identical n-neuron random neural networks, that act simultneously as mutual critics to reach the decision regarding which of n nodes have been compromised. A novel gradient learning descent algorithm is presented for the ARNN, and is shown to operate effectively both with conventional off-line training from prior data, and with on-line incremental training without prior off-line learning. Real data from a 107 node packet network is used with over 700,000 packets to evaluate the ARNN, showing that it provides accurate predictions. Comparisons with other well-known state of the art methods using the same learning and testing datasets, show that the ARNN offers significantly better performance.
Department of Computer Science, Faculty of Mathematics and Computer Science, and Interdisciplinary School for Doctoral Studies, University of Bucharest, Romania（布加勒斯特大学数学与计算机科学学院、跨学科博士研究学院）
Flooding attacks to internet threat monitors (ITM): Modeling and counter measures using botnet and honeypots
Internet Threat Monitoring（ITM）是一个全球范围的Internet监控系统，其目标是测量，检测，表征和跟踪威胁，如分布式拒绝服务（DDoS）攻击和蠕虫。为了阻止互联网上的监控系统，攻击者的目标是ITM系统。在本文中，我们解决的洪水攻击对ITM系统中，攻击者试图耗尽网络和ITM的资源，如网络带宽，计算能力，或操作系统数据结构发送恶意流量。我们提出了一个信息理论的框架，模型的洪水攻击使用僵尸网络的ITM。基于该模型，我们概括了洪水攻击，并提出了一种使用蜜罐的有效攻击检测方法。
Improving Botnet Detection with Recurrent Neural Network and Transfer Learning
Lawrence Berkeley National Laboratory（劳伦斯伯克利国家实验室）；Texas A&M University-Commerce（德克萨斯A&M大学-康默斯分校）；KISTI（韩国科学技术信息研究院）
僵尸网络检测是阻止僵尸网络传播和防止恶意活动的关键步骤。然而，可靠的检测仍然是一个具有挑战性的任务，由于各种各样的僵尸网络涉及不断增加的设备和攻击载体的类型。最近采用机器学习（ML）的方法显示出比早期方法改进的性能，但是这些基于ML的方法仍然具有显著的局限性。例如，大多数机器学习方法不能结合序列模式分析技术来检测某些类别的僵尸网络。基于ML的方法的另一个常见缺点是需要重新训练神经网络，以便检测不断发展的僵尸网络;然而，训练过程是耗时的，并且需要大量的工作来标记训练数据。对于快速发展的僵尸网络，在僵尸网络再次发生变化之前，创建足够的训练样本可能需要太长的时间。为了解决这些挑战，我们提出了一种新的僵尸网络检测方法，建立在循环变分自编码器（RVAE），有效地捕捉僵尸网络活动的顺序特征。在实验中，这种半监督学习方法取得了更好的检测精度比同类的学习方法，特别是对难以检测类。此外，我们设计了一个迁移学习框架，从精心策划的源数据集中学习，并将知识转移到以前从未见过的目标问题域。测试表明，使用迁移学习的真阳性率（TPR）高于使用目标数据集训练的RVAE半监督学习方法（91.8% vs. 68.3%）。
