Search results for "Botnet"
showing 6 items of 6 documents
DGA detection using machine learning methods
2016
Yksi yleisimmistä kyberhyökkäysistä on käyttää ryhmä yksityisiä tietokoneita (private computers), joita käytetään esimerkiksi salaisien tietojen levittämiseen. Näitä koneryhmiä kutsutaan botnet. Botnetit pysyvät havaitsemattomana käyttämällä Domain Name Generation (DGA) menetelmää, joka luo ajoittain ja ratkaisee suurina lukumäärinä erillaisia pseudosatunnaisia verkkotunnuksia, kunnes jokin näistä pseudosatunnaisista verkkotunnuksista DNS palvelin hyväksyy. Tämän tutkielman tarkoitus on kehitellä ei- ohjattuja koneoppimismenetelmiä ja vertailla näiden tarkkuutta ohjattuihin koneoppimismenetelmiin DGA hyökkäyksien havaitsemiseen. Lisäksi, tutkielmassa esitellään Random One Class Support Vect…
Security Challenges of IoT-Based Smart Home Appliances
2018
The Internet of Things, IoT, and the related security challenges are reaching homes in the form of smart appliances. If the appliances are compromised, they can be used in botnet attacks against Internet services and potentially cause harm to people and property through the local network, for example, by heating up too much or allowing unauthorized access. The aim of this study was to see how secure these devices are against remote and network attacks. Several devices were tested with attacks coming from the same Wi-Fi network to gain various levels of control of the devices. Their security against a Man-in-the-Middle attack was also studied to see differences in the susceptibility to conne…
On Detection of Network-Based Co-residence Verification Attacks in SDN-Driven Clouds
2017
Modern cloud environments allow users to consume computational and storage resources in the form of virtual machines. Even though machines running on the same cloud server are logically isolated from each other, a malicious customer can create various side channels to obtain sensitive information from co-located machines. In this study, we concentrate on timely detection of intentional co-residence attempts in cloud environments that utilize software-defined networking. SDN enables global visibility of the network state which allows the cloud provider to monitor and extract necessary information from each flow in every virtual network in online mode. We analyze the extracted statistics on d…
Deep in the Dark: A Novel Threat Detection System using Darknet Traffic
2019
This paper proposes a threat detection system based on Machine Learning classifiers that are trained using darknet traffic. Traffic destined to Darknet is either malicious or by misconfiguration. Darknet traffic contains traces of several threats such as DDoS attacks, botnets, spoofing, probes and scanning attacks. We analyse darknet traffic by extracting network traffic features from it that help in finding patterns of these advanced threats. We collected the darknet traffic from the network sensors deployed at SURFnet and extracted several network-based features. In this study, we proposed a framework that uses supervised machine learning and a concept drift detector. Our experimental res…
Yleiskatsaus Botnetteihin ja C&C-liikenteeseen
2016
Tässä kirjallisuuskatsauksessa luodaan yleiskatsaus botnetteihin ja niihin liittyviin ilmiöihin. Johdannossa perustellaan aiheen ajankohtaisuus. Luvussa 2 esitellään botnet pintapuolisena käsitteenä. Luvussa 3 esitellään tapoja luokitella botnettejä. Luvussa 4 esitetään botnettien hyödyntämiä tapoja piilottaa omaa viestiliikennettään ja luvussa 5 esitellään tapoja havaita kyseistä liikennettä. Lopuksi luvussa 6 suoritetaan yhteenveto. This literature review focuses on providing an overview on botnets and phenomenoms related to botnets. The first chapter argues for the relevancy of the topic. The second chapter presents the basic structure of a botnet. The third chapter further expands on th…
Domain Generation Algorithm Detection Using Machine Learning Methods
2018
A botnet is a network of private computers infected with malicious software and controlled as a group without the knowledge of the owners. Botnets are used by cybercriminals for various malicious activities, such as stealing sensitive data, sending spam, launching Distributed Denial of Service (DDoS) attacks, etc. A Command and Control (C&C) server sends commands to the compromised hosts to execute those malicious activities. In order to avoid detection, recent botnets such as Conficker, Zeus, and Cryptolocker apply a technique called Domain-Fluxing or Domain Name Generation Algorithms (DGA), in which the infected bot periodically generates and tries to resolve a large number of pseudorando…