1. Web Botnet Detection Based on Flow Information Chia-Mei Chen, Ya-Hui Ou, and Yu-Chou Tsai, National Sun Yat –Sen University,IEEE 2010

2. Outline The Proposed Approach TitleExperiment Environment Performance Ananlysis 2011/3/82

3. The Proposed Approach This study observes web botnet behaviors through Blackenergy. To distinguish abnormal web traffic from regular web requests, this study first conducts the experiments with normal web requests and one of the normal flows. 2011/3/83

4. The Proposed Approach Then, the experiments with web bots connecting to the C&C web server are conducted a sample. Such web flows are different from the normal user’s web browsing flows and can be used to identify web bots. 2011/3/84

5. 5

6. The Proposed Approach Attribute Analysis –The major features can be divided into timeslot, data calculating, mutual authentication bots clustering analysis. 2011/3/86

7. The Proposed Approach Attribute Analysis –Mutual authentication can be explained by flows data, to put it more concretely, if the flow data of B2S (bots link to server) is quite similar to S2B, represent that the flow data was extraordinary. –Clustering analysis, in brief, classes the same feature as the same group. 2011/3/87

8. the bots connect with HTTP Server have regular time interval every data exist similar value. 2011/3/88

9. TitleExperiment Environment –In the simulative environment, setting four bots regularly connect to server and perform the DDos attack to the victims after get the command, –the attack command as follows: 2011/3/89

10. TitleExperiment Environment 2011/3/810

11. Experiment Environment –When Blackenergy performed DDoS attacks, the flows were significant increase in a short time. 2011/3/811

12. Performance Analysis Experiment Environment –There are four different network environments: –(1) a simulated LAN initially with one infected bot and 13 normal clients, –(2) a simulated LAN initially with 3 botnets and some normal clients, 2011/3/812

13. Performance Analysis Experiment Environment –(3) a real LAN deployed initially with one infected bot machine and 19 normal clients, and –(4) a university dorm network. 2011/3/813

14. 2011/3/814

15. Performance Ananlysis Bot Infection Some Hosts in the LAN: – In this experiment, the system setting three botnets and three HTTP servers to obtain evidence of characteristics –designing time intervals are 1 minute, 10 minutes, and 15 minutes, respectively. 2011/3/815

16. 2011/3/816

17. Performance Ananlysis 3) Real Network Environment: 2011/3/817

18. Performance Ananlysis 4) Demonstrate the usefulness in real network: –The data were primarily collected by school dormitory and conducted in roughly five days. 2011/3/818

19. 2011/3/819