BotCloud: Detecting Botnets Using MapReduce

Jérôme François (1, 2) , Shaonan Wang (1, 2) , Walter Bronzi (2, 1) , Radu State (1, 2) , Thomas Engel (1, 2)

1 SnT - Interdisciplinary Centre for Security Relaibility and Trust
2 Uni.lu - Université du Luxembourg

Botnets are a major threat of the current Internet. Understanding the novel generation of botnets relying on peer-to-peer networks is crucial for mitigating this threat. Nowadays, botnet traffic is mixed with a huge volume of benign traffic due to almost ubiquitous high speed networks. Such networks can be monitored using IP flow records but their forensic analysis form the major computational bottleneck. We propose in this paper a distributed computing framework that leverages a host dependency model and an adapted PageRank algorithm. We report experimental results from an open-source based Hadoop cluster and highlight the performance benefits when using real network traces from an Internet operator.

Domaines: Réseaux et télécommunications [cs.NI]

Jérôme François, Shaonan Wang, Walter Bronzi, Radu State, Thomas Engel. BotCloud: Detecting Botnets Using MapReduce. International Workshop on Information Forensics and Security - WIFS, Nov 2011, Foz do Iguaçu, Brazil. Paper #55. ⟨hal-00658186⟩