Skip to main content

Research Repository

Advanced Search

Detecting Botnets Through Log Correlation

Al-Hammadi, Yousof; Aickelin, Uwe

Authors

Yousof Al-Hammadi

Uwe Aickelin



Abstract

Botnets, which consist of thousands of compromised machines, can cause a significant threat to other systems by launching Distributed Denial of Service attacks, keylogging, and backdoors. In response to this threat, new effective techniques are needed to detect the presence of botnets. In this paper, we have used an interception technique to monitor Windows Application Programming Interface system calls made by communication applications. Existing approaches for botnet detection are based on finding bot traffic patterns. Our approach does not depend on finding patterns but rather monitors the change of behaviour in the system. In addition, we will present our idea of detecting botnet based on log correlations from different hosts.

Citation

Al-Hammadi, Y., & Aickelin, U. Detecting Botnets Through Log Correlation

Conference Name Proceedings of the Workshop on Monitoring, Attack Detection and Mitigation (MonAM 2006)
Deposit Date Oct 17, 2007
Peer Reviewed Peer Reviewed
Public URL http://eprints.nottingham.ac.uk/id/eprint/595
Copyright Statement Copyright information regarding this work can be found at the following address: http://eprints.nottingham.ac.uk/end_user_agreement.pdf

Files


06monam_bots.pdf (110 Kb)
PDF

Copyright Statement
Copyright information regarding this work can be found at the following address: http://eprints.nottingham.ac.uk/end_user_agreement.pdf





You might also like



Downloadable Citations