BotHunter: detecting malware infection through IDS-driven dialog correlation

摘要: We present a new kind of network perimeter monitoring strategy, which focuses on recognizing the infection and coordination dialog that occurs during successful malware infection. BotHunter is an application designed to track two-way communication flows between internal assets external entities, developing evidence trail data exchanges match state-based sequence model. consists correlation engine driven by three malware-focused packet sensors, each charged with detecting specific stages process, including inbound scanning, exploit usage, egg downloading, outbound bot dialog, attack propagation. The correlator then ties together intrusion alarms those patterns are highly indicative local host When found BotHunter's model, consolidated report produced capture all relevant events event sources played role process. refer this analytical strategy matching broader Internet as dialog-based correlation, contrast other detection alert methods. our experimental results using in both virtual live testing environments, discuss release prototype. made available for operational use help stimulate research understanding life cycle infections.