Monitoring Peer-to-Peer Botnets:Requirements,Challenges,and Future Works

The cyber-criminal compromises end-hosts(bots)to configure a network of bots(botnet).The cyber-criminals are also looking for an evolved architecture that makes their techniques more resilient and stealthier such as Peer-to-Peer(P2P)networks.The P2P botnets leverage the privileges of the decentralized nature of P2P networks.Consequently,the P2P botnets exploit the resilience of this architecture to be arduous against take-down procedures.Some P2P botnets are smarter to be stealthy in their Commandand-Control mechanisms(C2)and elude the standard discovery mechanisms.Therefore,the other side of this cyberwar is the monitor.The P2P botnet monitoring is an exacting mission because the monitoring must care about many aspects simultaneously.Some aspects pertain to the existing monitoring approaches,some pertain to the nature of P2P networks,and some to counter the botnets,i.e.,the anti-monitoring mechanisms.All these challenges should be considered in P2P botnet monitoring.To begin with,this paper provides an anatomy of P2P botnets.Thereafter,this paper exhaustively reviews the existing monitoring approaches of P2P botnets and thoroughly discusses each to reveal its advantages and disadvantages.In addition,this paper groups the monitoring approaches into three groups:passive,active,and hybrid monitoring approaches.Furthermore,this paper also discusses the functional and non-functional requirements of advanced monitoring.In conclusion,this paper ends by epitomizing the challenges of various aspects and gives future avenues for better monitoring of P2P botnets.

Double DQN Method For Botnet Traffic Detection System

In the face of the increasingly severe Botnet problem on the Internet,how to effectively detect Botnet traffic in realtime has become a critical problem.Although the existing deepQnetwork(DQN)algorithminDeep reinforcement learning can solve the problem of real-time updating,its prediction results are always higher than the actual results.In Botnet traffic detection,although it performs well in the training set,the accuracy rate of predicting traffic is as high as%;however,in the test set,its accuracy has declined,and it is impossible to adjust its prediction strategy on time based on new data samples.However,in the new dataset,its accuracy has declined significantly.Therefore,this paper proposes a Botnet traffic detection system based on double-layer DQN(DDQN).Two Q-values are designed to adjust the model in policy and action,respectively,to achieve real-time model updates and improve the universality and robustness of the model under different data sets.Experiments show that compared with the DQN model,when using DDQN,the Q-value is not too high,and the detectionmodel has improved the accuracy and precision of Botnet traffic.Moreover,when using Botnet data sets other than the test set,the accuracy and precision of theDDQNmodel are still higher than DQN.

IoT Smart Devices Risk Assessment Model Using Fuzzy Logic and PSO

Increasing Internet of Things(IoT)device connectivity makes botnet attacks more dangerous,carrying catastrophic hazards.As IoT botnets evolve,their dynamic and multifaceted nature hampers conventional detection methods.This paper proposes a risk assessment framework based on fuzzy logic and Particle Swarm Optimization(PSO)to address the risks associated with IoT botnets.Fuzzy logic addresses IoT threat uncertainties and ambiguities methodically.Fuzzy component settings are optimized using PSO to improve accuracy.The methodology allows for more complex thinking by transitioning from binary to continuous assessment.Instead of expert inputs,PSO data-driven tunes rules and membership functions.This study presents a complete IoT botnet risk assessment system.The methodology helps security teams allocate resources by categorizing threats as high,medium,or low severity.This study shows how CICIoT2023 can assess cyber risks.Our research has implications beyond detection,as it provides a proactive approach to risk management and promotes the development of more secure IoT environments.

基于改进YOLOv8的火灾目标检测系统

火灾发生初期,烟雾状态变化多端火焰的尺寸大小也非常小,现有的目标检测算法面对这复杂情况下会出现检测速度慢、检测准确率低。针对类似这样的问题,本文提出了基于改进YOLOv8的火灾目标检测系统。在YOLOv8的骨干网络末端添加BotNet结构,用来增强网络对火灾的特征提取,在YOLOv8的头部末端引入EMA注意力机制防止权重剧烈变化。改进的YOLOv8模型提高了目标检测的精确度。实验的结果表明,改进的YOLOv8模型与YOLOv8模型对比,改进的YOLOv8模型在mAP上提高了2.3%、火灾与烟雾的预测准确率也分别提高了1.4%和1%,进一步说明改进的YOLOv8模型可以满足对火灾的目标检测。

An Adaptive Push-Styled Command and Control Mechanism in Mobile Botnets

The mobile botnet, developed from the traditional PC-based botnets, has become a practical underlying trend. In this paper, we design a mobile botnet, which exploits a novel command and control （CC） strategy named Push-Styled CC. It utilizes Google cloud messaging （GCM） service as the botnet channel. Compared with traditional botnet, Push-Styled CC avoids direct communications between botmasters and bots, which makes mobile botnets more stealthy and resilient. Since mobile devices users are sensitive to battery power and traffic consumption, Push- Styled botnet also applies adaptive network connection strategy to reduce traffic consumption and cost. To prove the efficacy of our design, we implemented the prototype of Push-Style CC in Android. The experiment results show that botnet traffic can be concealed in legal GCM traffic with low traffic cost.

Mining Botnets and Their Evolution Patterns

The botnet is the network of compromised computers that have fallen under the control of hackers after being infected by malicious programs such as trojan viruses. The compromised machines are mobilized to perform various attacks including mass spamming, distributed denial of service （DDoS） and additional trojans. This is becoming one of the most serious threats to the Internet infrastructure at present. We introduce a method to uncover compromised machines and characterize their behaviors using large email logs. We report various spain campaign variants with different characteristics and introduce a statistical method to combine them. We also report the long-term evolution patterns of the spare campaigns.

Analysis on the time-domain characteristics of botnets control traffic

Botnets are networks composed with malware-infect ed computers.They are designed and organized to be controlled by an adversary.As victims are infected through their inappropriate network behaviors in most cases,the Internet protocol（IP） addresses of infected bots are unpredictable.Plus,a bot can get an IP address through dynamic host configuration protocol（DHCP）,so they need to get in touch with the controller initiatively and they should attempt continuously because a controller can＇t be always online.The whole process is carried out under the command and control（C＆C） channel.Our goal is to characterize the network traffic under the C＆C channel on the time domain.Our analysis draws upon massive data obtained from honeynet and a large Internet service provider（ISP） Network.We extract and summarize fingerprints of the bots collected in our honeynet.Next,with the fingerprints,we use deep packet inspection（DPI） Technology to search active bots and controllers in the Internet.Then,we gather and analyze flow records reported from network traffic monitoring equipments.In this paper,we propose a flow record interval analysis on the time domain characteristics of botnets control traffic,and we propose the algorithm to identify the communications in the C＆C channel based on our analysis.After that,we evaluate our approach with a 3.4 GB flow record trace and the result is satisfactory.In addition,we believe that our work is also useful information in the design of botnet detection schemes with the deep flow inspection（DFI） technology.

基于改进YOLO v5s的轻量化植物识别模型研究

为方便调查宁夏全区荒漠草原植物种类及其分布,需对植物识别方法进行研究。针对YOLO v5s模型参数量大,对复杂背景下的植物不易识别等问题,提出一种复杂背景下植物目标识别轻量化模型YOLO v5s-CBD。改进模型YOLO v5s-CBD在特征提取网络中引入带有Transformer模块的主干网络BoTNet(Bottleneck transformer network),使卷积和自注意力相结合,提高模型的感受野;同时在特征提取网络融入坐标注意力(Coordinate attention,CA),有效捕获通道和位置的关系,提高模型的特征提取能力;引入SIoU函数计算回归损失,解决预测框与真实框不匹配问题;使用深度可分离卷积(Depthwise separable convolution,DSC)减小模型内存占用量。实验结果表明,YOLO v5s-CBD模型在单块Nvidia GTX A5000 GPU单幅图像推理时间仅为8 ms,模型内存占用量为8.9 MB,精确率P为95.1%,召回率R为92.9%,综合评价指标F1值为94.0%,平均精度均值(mAP)为95.7%,在VOC数据集平均精度均值可达80.09%。相比YOLO v3-tiny、YOLO v4-tiny和YOLO v5s,改进模型内存占用量减小,平均精度均值提升。模型YOLO v5s-CBD在公开数据集和宁夏荒漠草原植物数据集都有良好的鲁棒性,推理速度更快,且易于部署,已应用在宁夏荒漠草原移动端植物图像识别APP和定点生态信息观测平台,可用来调查宁夏全区荒漠草原植物种类和分布,长期观测和跟踪宁夏盐池县大水坑、黄记场、麻黄山等地植物生态信息。

基于Snort的Botnet网络检测系统设计研究

Botnet网络作为极具威胁的攻击类型,往往被用来发动大规模网络破坏活动。在Botnet网络中,为了保持服务器的隐蔽性、可用性,与域名关联的IP地址需要不停变动,而传统检测系统针对组织Botnet网络攻击显然已失效。因此,为了有效识别未知、潜伏的Botnet网络,该文设计了一种基于Snort的Botnet网络检测系统,并与传统检测系统进行比较。结果表明,该系统可以实时监测网络流量,从而快速检测攻击行为,检测正确率较高,具有良好的扩展性、可移植性。

基于BCE-YOLOv5的苹果叶部病害检测方法

针对自然环境中,人工目视解译苹果叶部病害耗时耗力、人为主观因素强的问题。本研究提出了一种融合自注意力机制和Transformer模块的目标检测算法——BCE-YOLOv5,实现对自然环境下对苹果叶片病虫害的自动识别与检测。该算法首先使用BotNet、ConvNeXt模块分别替换Backbone网络和Neck网络的CSP结构,增加自注意力机制对目标的特征提取能力。通过将改进的CBAM引入YOLOv5的特征融合网络之后,使注意力机制对特征融合信息更加地关注。最后,用α-IoU损失函数替换IoU损失函数,使得网络在模型训练过程中收敛的更加稳定。BCE-YOLOv5算法在传统算法YOLOv5基础上平均精准率均值提升了2.9百分点,并且改进后的算法的模型大小和计算量较传统算法分别减小了0.2 M和0.9 GFLOPs。平均精度均值比YOLOv4s、YOLOv6s、YOLOx-s和YOLOv7模型分别高2.5、1.3、3.5、2.2百分点。该方法能快速准确识别苹果叶部病害,为苹果种植过程中提供智能化管理做参考。

基于YOLOv5算法改进的钢材表面缺陷检测

钢材表面缺陷检测一直是目标检测领域重要的研究问题。针对该问题,该文以东北大学开源数据集NEU-DET为样本数据,对YOLOv5算法进行改进,得到YOLOv5_LH网络模型。首先对聚类算法进行优化,使用K-means++算法优化锚框,然后把主干网络中Conv层更换为特征提取能力更强的RepVGG网络,并在SPPF层前添加BotNet注意力机制,在Neck层引用BiFPN特征金字塔替代原有的网络结构,同时也对损失函数进行优化。通过实验验证,YOLOv5_LH算法在NEU-DET数据集上的mAP值达到88.5%,检测速度为70.1 fps,相对于YOLOv5s算法提高了11.7%,该算法在保证检测速度的同时提高识别准确率。

MBB-IoT:Construction and Evaluation of IoT DDoS Traffic Dataset from a New Perspective

Distributed Denial of Service(DDoS)attacks have always been a major concern in the security field.With the release of malware source codes such as BASHLITE and Mirai,Internet of Things(IoT)devices have become the new source of DDoS attacks against many Internet applications.Although there are many datasets in the field of IoT intrusion detection,such as Bot-IoT,ConstrainedApplication Protocol–Denial of Service(CoAPDoS),and LATAM-DDoS-IoT(some of the names of DDoS datasets),which mainly focus on DDoS attacks,the datasets describing new IoT DDoS attack scenarios are extremely rare,and only N-BaIoT and IoT-23 datasets used IoT devices as DDoS attackers in the construction process,while they did not use Internet applications as victims either.To supplement the description of the new trend of DDoS attacks in the dataset,we built an IoT environment with mainstream DDoS attack tools such as Mirai and BASHLITE being used to infect IoT devices and implement DDoS attacks against WEB servers.Then,data aggregated into a dataset namedMBB-IoTwere captured atWEBservers and IoT nodes.After the MBB-IoT dataset was split into a training set and a test set,it was applied to the training and testing of the Random Forests classification algorithm.The multi-class classification metrics were good and all above 90%.Secondly,in a cross-evaluation experiment based on Support Vector Machine(SVM),Light Gradient Boosting Machine(LightGBM),and Long Short Term Memory networks(LSTM)classification algorithms,the training set and test set were derived from different datasets(MBB-IoT or IoT-23),and the test performance is better when MBB-IoT is used as the training set.

Preventing Cloud Network from Spamming Attacks Using Cloudflare and KNN

Cloud computing is one of the most attractive and cost-saving models,which provides online services to end-users.Cloud computing allows the user to access data directly from any node.But nowadays,cloud security is one of the biggest issues that arise.Different types of malware are wreaking havoc on the clouds.Attacks on the cloud server are happening from both internal and external sides.This paper has developed a tool to prevent the cloud server from spamming attacks.When an attacker attempts to use different spamming techniques on a cloud server,the attacker will be intercepted through two effective techniques:Cloudflare and K-nearest neighbors(KNN)classification.Cloudflare will block those IP addresses that the attacker will use and prevent spamming attacks.However,the KNN classifiers will determine which area the spammer belongs to.At the end of the article,various prevention techniques for securing cloud servers will be discussed,a comparison will be made with different papers,a conclusion will be drawn based on different results.

Detecting Android Botnet Applications Using Convolution Neural Network

The exponential growth in the development of smartphones and handheld devices is permeated due to everyday activities i.e.,games applications,entertainment,online banking,social network sites,etc.,and also allow the end users to perform a variety of activities.Because of activities,mobile devices attract cybercriminals to initiate an attack over a diverse range of malicious activities such as theft of unauthorized information,phishing,spamming,Distributed Denial of Services(DDoS),and malware dissemination.Botnet applications are a type of harmful attack that can be used to launch malicious activities and has become a significant threat in the research area.A botnet is a collection of infected devices that are managed by a botmaster and communicate with each other via a command server in order to carry out malicious attacks.With the rise in malicious attacks,detecting botnet applications has become more challenging.Therefore,it is essential to investigate mobile botnet attacks to uncover the security issues in severe financial and ethical damages caused by a massive coordinated command server.Current state of the art,various solutions were provided for the detection of botnet applications,but in general,the researchers suffer various techniques of machine learning-based methods with static features which are usually ineffective when obfuscation techniques are used for the detection of botnet applications.In this paper,we propose an approach by exploring the concept of a deep learning-based method and present a well-defined Convolutional Neural Network(CNN)model.Using the visualization approach,we obtain the colored images through byte code files of applications and perform an experiment.For analysis of the results of an experiment,we differentiate the performance of the model from other existing research studies.Furthermore,our method outperforms with 94.34%accuracy,92.9%of precision,and 92%of recall.

BotSward: Centrality Measures for Graph-Based Bot Detection Using Machine Learning

The number of botnet malware attacks on Internet devices has grown at an equivalent rate to the number of Internet devices that are connected to the Internet.Bot detection using machine learning(ML)with flow-based features has been extensively studied in the literature.Existing flow-based detection methods involve significant computational overhead that does not completely capture network communication patterns that might reveal other features ofmalicious hosts.Recently,Graph-Based Bot Detection methods using ML have gained attention to overcome these limitations,as graphs provide a real representation of network communications.The purpose of this study is to build a botnet malware detection system utilizing centrality measures for graph-based botnet detection and ML.We propose BotSward,a graph-based bot detection system that is based on ML.We apply the efficient centrality measures,which are Closeness Centrality(CC),Degree Centrality(CC),and PageRank(PR),and compare them with others used in the state-of-the-art.The efficiency of the proposed method is verified on the available Czech Technical University 13 dataset(CTU-13).The CTU-13 dataset contains 13 real botnet traffic scenarios that are connected to a command-and-control(C&C)channel and that cause malicious actions such as phishing,distributed denial-of-service(DDoS)attacks,spam attacks,etc.BotSward is robust to zero-day attacks,suitable for large-scale datasets,and is intended to produce better accuracy than state-of-the-art techniques.The proposed BotSward solution achieved 99%accuracy in botnet attack detection with a false positive rate as low as 0.0001%.

Toward Secure Software-Defined Networks Using Machine Learning: A Review, Research Challenges, and Future Directions

Over the past few years,rapid advancements in the internet and communication technologies have led to increasingly intricate and diverse networking systems.As a result,greater intelligence is necessary to effectively manage,optimize,and maintain these systems.Due to their distributed nature,machine learning models are challenging to deploy in traditional networks.However,Software-Defined Networking(SDN)presents an opportunity to integrate intelligence into networks by offering a programmable architecture that separates data and control planes.SDN provides a centralized network view and allows for dynamic updates of flow rules and softwarebased traffic analysis.While the programmable nature of SDN makes it easier to deploy machine learning techniques,the centralized control logic also makes it vulnerable to cyberattacks.To address these issues,recent research has focused on developing powerful machine-learning methods for detecting and mitigating attacks in SDN environments.This paper highlighted the countermeasures for cyberattacks on SDN and how current machine learningbased solutions can overcome these emerging issues.We also discuss the pros and cons of using machine learning algorithms for detecting and mitigating these attacks.Finally,we highlighted research issues,gaps,and challenges in developing machine learning-based solutions to secure the SDN controller,to help the research and network community to develop more robust and reliable solutions.

Design the IoT Botnet Defense Process for Cybersecurity in Smart City

The smart city comprises various infrastructures,including health-care,transportation,manufacturing,and energy.A smart city’s Internet of Things(IoT)environment constitutes a massive IoT environment encom-passing numerous devices.As many devices are installed,managing security for the entire IoT device ecosystem becomes challenging,and attack vectors accessible to attackers increase.However,these devices often have low power and specifications,lacking the same security features as general Information Technology(IT)systems,making them susceptible to cyberattacks.This vulnerability is particularly concerning in smart cities,where IoT devices are connected to essential support systems such as healthcare and transportation.Disruptions can lead to significant human and property damage.One rep-resentative attack that exploits IoT device vulnerabilities is the Distributed Denial of Service(DDoS)attack by forming an IoT botnet.In a smart city environment,the formation of IoT botnets can lead to extensive denial-of-service attacks,compromising the availability of services rendered by the city.Moreover,the same IoT devices are typically employed across various infrastructures within a smart city,making them potentially vulnerable to similar attacks.This paper addresses this problem by designing a defense process to effectively respond to IoT botnet attacks in smart city environ-ments.The proposed defense process leverages the defense techniques of the MITRE D3FEND framework to mitigate the propagation of IoT botnets and support rapid and integrated decision-making by security personnel,enabling an immediate response.

Improved Ant Colony Optimization and Machine Learning Based Ensemble Intrusion Detection Model

Internet of things(IOT)possess cultural,commercial and social effect in life in the future.The nodes which are participating in IOT network are basi-cally attracted by the cyber-attack targets.Attack and identification of anomalies in IoT infrastructure is a growing problem in the IoT domain.Machine Learning Based Ensemble Intrusion Detection(MLEID)method is applied in order to resolve the drawback by minimizing malicious actions in related botnet attacks on Message Queue Telemetry Transport(MQTT)and Hyper-Text Transfer Proto-col(HTTP)protocols.The proposed work has two significant contributions which are a selection of features and detection of attacks.New features are chosen from Improved Ant Colony Optimization(IACO)in the feature selection,and then the detection of attacks is carried out based on a combination of their possible proper-ties.The IACO approach is focused on defining the attacker’s important features against HTTP and MQTT.In the IACO algorithm,the constant factor is calculated against HTTP and MQTT based on the mean function for each element.Attack detection,the performance of several machine learning models are Distance Deci-sion Tree(DDT),Adaptive Neuro-Fuzzy Inference System(ANFIS)and Mahala-nobis Distance Support Vector Machine(MDSVM)were compared with predicting accurate attacks on the IoT network.The outcomes of these classifiers are combined into the ensemble model.The proposed MLEID strategy has effec-tively established malicious incidents.The UNSW-NB15 dataset is used to test the MLEID technique using data from simulated IoT sensors.Besides,the pro-posed MLEID technique has a greater detection rate and an inferior rate of false-positive compared to other conventional techniques.

一种高鲁棒性的新型P2P僵尸网络

提出一种利用认证sensor组建的蜜罐先知型半分布式P2P僵尸网络(Botnet),通过连接比C(p)和度数比D(p)2个度量函数,并在peer-list更新过程中使用不同数量servent bots,讨论其鲁棒性的变化。结果表明,与传统Botnet相比,该类Botnet具有较高的鲁棒性。

网络恶意程序“Botnet”的检测技术的分析

目前Botnet技术发展最为快速,不论是对网络安全运行还是用户数据安全的保护来说,Botnet都是极具威胁的隐患。介绍了Botnet技术的同时也对Botnet检测技术进行了研究,对几种主要的Botnet检测技术进行了深入分析。