(Press-News.org) Contact information: Albert Ang
press@inderscience.com
Inderscience Publishers
Finding the hidden zombie in your network
Statistical approach to unraveling computer botnets
How do you detect a "botnet", a network of computers infected with malware -so-called zombies - that allow a third party to take control of those machines? The answer may lie in a statistical tool first published in 1966 and brought into the digital age researchers writing this month in the International Journal of Electronic Security and Digital Forensics.
Millions of computers across the globe are infected with malware, despite the best efforts of public awareness campaigns about phishing attacks and antivirus software. Much of the infection is directed towards allowing a third party to take control of a given machine or indeed a network of machines and exploiting them unbeknownst the legitimate users in malicious and criminal activity. Security and software companies do monitor internet activity and there have been many well-publicized successes in destroying such botnets. However, malware writers are always developing new tools and techniques that allow them to infect unprotected computers and rebuild botnets.
Botnets are widely used in organized crime to attempt breaches on security systems by mounting distributed denial of service (dDOS) attacks, among other techniques, on corporate, banking and government systems. Such attacks can open up "backdoors" into a private computer network that lets the botnet controller access proprietary and other sensitive information, passwords or even voting systems. Botnets have also been used for simply malicious purposes to force websites and other services offline, occasionally in an act of protest or rebellion.
Now, R. Anitha and colleagues at PSG College of Technology, Coimbatore, India, have turned to a statistical tool known as the hidden semi-Markov model (HsMM) to help them develop monitoring software that can detect the telltale signs of botnet activity on a computer and so disable the offending malware. In probability theory and statistics, a Markov process is one in which someone can predict the next state of a process based on its current state without knowing the full history of the process. An example in gambling would be that if you have chip now and the odds of winning or losing on the next bet are even then we can predict without knowing how many chips you had earlier that you will either have none or two after the next bet.
A hidden-Markov model would thus include variables of which the observer has no sight but can infer and so predict an outcome. Predicting whether it rained on a given day based on whether a fair-weather-only walker was out on a given day without you having a weather report for their area involves a hidden-Markov process. A hidden semi-Markov model then involves a process of this sort but where the time-elapsed into the current state affects the prediction. For example, one might predict the rainfall pattern based on how long it is since our fair-weather walk last ventured out.
The team has applied the statistical logic of the hidden semi-Markov model to forecast the characteristics of internet activity on a given computer suspected of being a "zombie computer" in a botnet based on management information base (MIB) variables. These variables are the components used to control the flow of data packets in and out of the computer via the internet protocol. Their approach can model the "normal" behavior and then highlight botnet activity as being a deviation from the normal without the specific variables that are altered by the malware being in plain sight.
The team points out that botnet and malware developers have focused recently on web-based, http, type activity, which is easier to disguise among the myriad packets of data moving to and fro across a network and in and out of a particular computer. Their tests on a small zombie computer network shows that the hidden semi-Markov model they have developed as a lightweight and real-time detection system can see through this disguise easily. If implemented widely such as system could lock down this kind of botnet very quickly and slow the assimilation of zombie computers by criminals and others with malicious intent.
###
"HTTP botnet detection using hidden semi-Markov model with SNMP MIB variables" in Int. J. Electronic Security and Digital Forensics, 2014, 5, 188-200.
Finding the hidden zombie in your network
Statistical approach to unraveling computer botnets
2014-02-04
ELSE PRESS RELEASES FROM THIS DATE:
Who owns the bones? Should bodies in museum exhibits be returned home?
2014-02-04
From Egyptian mummies to Ötzi the Iceman, human remains are a common, if macabre, feature of museum exhibits. Writing in Clinical Anatomy, Dr. Philippe Charlier explores the argument that curators have ...
First live births with a novel simplified IVF procedure
2014-02-04
Cambridge, UK, February 4, 2014 - A recent prospective study published in Reproductive BioMedicine Online comparing conventional IVF with a novel simplified laboratory method of culturing embryos suggested that fertilization ...
Smokers lack motivation, feel more tired and are less active than non-smokers
2014-02-04
While the results of smoking may be expected to decrease fitness, new research, published in Respirology, has found that smokers are less physically active, lack motivation and are more likely to ...
Time to stub out misguided e-cigarette regulation
2014-02-04
Los Angeles, London (February 04, 2014). Smokers are increasingly turning to electronic cigarettes as a means to reduce the health impacts of their addiction. But legislators around the world are far from unified ...
Faces we don't forget
2014-02-04
Great eyes, full lips and harmonious features: actress Angelina Jolie is in possession of all of these. That she is regarded as ...
Teens who consume energy drinks more likely to use alcohol and drugs
2014-02-04
Philadelphia, Pa. (February 4, 2014) – Nearly one-third ...
Mouse study shows gene therapy may be possible cure for Hurler syndrome
2014-02-04
CINCINNATI – Researchers used blood platelets and bone marrow cells to deliver potentially curative gene therapy to mouse models of the human genetic disorder Hurler ...
Scientists turn primitive artificial cell into complex biological materials
2014-02-04
It is a big dream in science: To start from scratch with simple artificial microskopic building blocks and end up with something much more complex: living systemts, novel computers or every-day ...
Sun spits out mid-level solar flare
2014-02-04
The sun emitted a mid-level solar flare, beginning at 11:57 p.m. EST on Feb. 3, 2014, and peaking at midnight EST. NASA released images of the flare as captured ...
Diamond defect boosts quantum technology
2014-02-04
Washington, D.C.—New research shows that a remarkable defect in synthetic diamond produced by chemical vapor deposition allows researchers to measure, witness, and potentially manipulate electrons in a manner that could ...
LAST 30 PRESS RELEASES:
A third of licensed GPs in England not working in NHS general practice
ChatGPT “thought on the fly” when put through Ancient Greek maths puzzle
Engineers uncover why tiny particles form clusters in turbulent air
GLP-1RA drugs dramatically reduce death and cardiovascular risk in psoriasis patients
Psoriasis linked to increased risk of vision-threatening eye disease, study finds
Reprogramming obesity: New drug from Italian biotech aims to treat the underlying causes of obesity
Type 2 diabetes may accelerate development of multiple chronic diseases, particularly in the early stages, UK Biobank study suggests
Resistance training may improve nerve health, slow aging process, study shows
Common and inexpensive medicine halves the risk of recurrence in patients with colorectal cancer
SwRI-built instruments to monitor, provide advanced warning of space weather events
Breakthrough advances sodium-based battery design
New targeted radiation therapy shows near-complete response in rare sarcoma patients
Does physical frailty contribute to dementia?
Soccer headers and brain health: Study finds changes within folds of the brain
Decoding plants’ language of light
UNC Greensboro study finds ticks carrying Lyme disease moving into western NC
New implant restores blood pressure balance after spinal cord injury
New York City's medical specialist advantage may be an illusion, new NYU Tandon research shows
Could a local anesthetic that doesn’t impair motor function be within reach?
1 in 8 Italian cetacean strandings show evidence of fishery interactions, with bottlenose and striped dolphins most commonly affected, according to analysis across four decades of data and more than 5
In the wild, chimpanzees likely ingest the equivalent of several alcoholic drinks every day
Warming of 2°C intensifies Arctic carbon sink but weakens Alpine sink, study finds
Bronze and Iron Age cultures in the Middle East were committed to wine production
Indian adolescents are mostly starting their periods at an earlier age than 25 years ago
Temporary medical centers in Gaza known as "Medical Points" (MPs) treat an average of 117 people daily with only about 7 staff per MP
Rates of alcohol-induced deaths among the general population nearly doubled from 1999 to 2024
PLOS One study: In adolescent lab animals exposed to cocaine, High-Intensity Interval Training boosts aversion to the drug
Scientists identify four ways our bodies respond to COVID-19 vaccines
Stronger together: A new fusion protein boosts cancer immunotherapy
Hidden brain waves as triggers for post-seizure wandering
[Press-News.org] Finding the hidden zombie in your networkStatistical approach to unraveling computer botnets