Towards automated detection of peer-to-peer botnets: on the limits of local approaches

摘要: State-of-the-art approaches for the detection of peer-to-peer (P2P) botnets are on one hand mostly local and other tailored to specific involving a great amount human time, effort, skill creativity. Enhancing or even replacing this labor-intensive process with automated and, if possible, network monitoring tools is clearly extremely desirable. To investigate feasibility monitoring, we present an experimental analysis traffic dispersion graph (TDG)--a key concept in P2P detection--of overlay maintenance search as seen at single AS. We focus feasible scenario where imaginary botnet uses some basic techniques hide its network. The simulations carried out AS-level model Internet. show that visibility any AS (let alone router) can be very limited. While strongly believe mapping complete our results imply it cannot achieved by approach: will inevitably require close cooperation among many different administrative domains state-of-the-art algorithms well.