Sciweavers

Share
ICDCS
2010
IEEE

Are Your Hosts Trading or Plotting? Telling P2P File-Sharing and Bots Apart

8 years 7 months ago
Are Your Hosts Trading or Plotting? Telling P2P File-Sharing and Bots Apart
—Peer-to-peer (P2P) substrates are now widely used for both file-sharing and botnet command-andcontrol. Despite the commonality of their substrates, we show that the different goals and circumstances of these applications give rise to behaviors that can be distinguished in network flow records. Using features related to traffic volume, “churn” among peers, and differences between human-driven and machine-driven traffic, we develop a technique for identifying P2P bots (the Plotters) and, in particular, separating them from file-sharing hosts (the Traders). Evaluations performed on traffic recorded at the edge of a university network show that we can achieve, e.g., 87.50% detection of Storm bots with a 0.47% false positive rate. We also demonstrate the significant extent to which Plotter behaviors would need to change to evade our technique.
Ting-Fang Yen, Michael K. Reiter
Added 15 Aug 2010
Updated 15 Aug 2010
Type Conference
Year 2010
Where ICDCS
Authors Ting-Fang Yen, Michael K. Reiter
Comments (0)
books