PRESS-NEWS.org - Press Release Distribution
PRESS RELEASES DISTRIBUTION

Finding the hidden zombie in your network

Statistical approach to unraveling computer botnets

2014-02-04
(Press-News.org) Contact information: Albert Ang
press@inderscience.com
Inderscience Publishers
Finding the hidden zombie in your network Statistical approach to unraveling computer botnets How do you detect a "botnet", a network of computers infected with malware -so-called zombies - that allow a third party to take control of those machines? The answer may lie in a statistical tool first published in 1966 and brought into the digital age researchers writing this month in the International Journal of Electronic Security and Digital Forensics.

Millions of computers across the globe are infected with malware, despite the best efforts of public awareness campaigns about phishing attacks and antivirus software. Much of the infection is directed towards allowing a third party to take control of a given machine or indeed a network of machines and exploiting them unbeknownst the legitimate users in malicious and criminal activity. Security and software companies do monitor internet activity and there have been many well-publicized successes in destroying such botnets. However, malware writers are always developing new tools and techniques that allow them to infect unprotected computers and rebuild botnets.

Botnets are widely used in organized crime to attempt breaches on security systems by mounting distributed denial of service (dDOS) attacks, among other techniques, on corporate, banking and government systems. Such attacks can open up "backdoors" into a private computer network that lets the botnet controller access proprietary and other sensitive information, passwords or even voting systems. Botnets have also been used for simply malicious purposes to force websites and other services offline, occasionally in an act of protest or rebellion.

Now, R. Anitha and colleagues at PSG College of Technology, Coimbatore, India, have turned to a statistical tool known as the hidden semi-Markov model (HsMM) to help them develop monitoring software that can detect the telltale signs of botnet activity on a computer and so disable the offending malware. In probability theory and statistics, a Markov process is one in which someone can predict the next state of a process based on its current state without knowing the full history of the process. An example in gambling would be that if you have chip now and the odds of winning or losing on the next bet are even then we can predict without knowing how many chips you had earlier that you will either have none or two after the next bet.

A hidden-Markov model would thus include variables of which the observer has no sight but can infer and so predict an outcome. Predicting whether it rained on a given day based on whether a fair-weather-only walker was out on a given day without you having a weather report for their area involves a hidden-Markov process. A hidden semi-Markov model then involves a process of this sort but where the time-elapsed into the current state affects the prediction. For example, one might predict the rainfall pattern based on how long it is since our fair-weather walk last ventured out.

The team has applied the statistical logic of the hidden semi-Markov model to forecast the characteristics of internet activity on a given computer suspected of being a "zombie computer" in a botnet based on management information base (MIB) variables. These variables are the components used to control the flow of data packets in and out of the computer via the internet protocol. Their approach can model the "normal" behavior and then highlight botnet activity as being a deviation from the normal without the specific variables that are altered by the malware being in plain sight.

The team points out that botnet and malware developers have focused recently on web-based, http, type activity, which is easier to disguise among the myriad packets of data moving to and fro across a network and in and out of a particular computer. Their tests on a small zombie computer network shows that the hidden semi-Markov model they have developed as a lightweight and real-time detection system can see through this disguise easily. If implemented widely such as system could lock down this kind of botnet very quickly and slow the assimilation of zombie computers by criminals and others with malicious intent.

### "HTTP botnet detection using hidden semi-Markov model with SNMP MIB variables" in Int. J. Electronic Security and Digital Forensics, 2014, 5, 188-200.


ELSE PRESS RELEASES FROM THIS DATE:

Who owns the bones? Should bodies in museum exhibits be returned home?

2014-02-04
From Egyptian mummies to Ötzi the Iceman, human remains are a common, if macabre, feature of museum exhibits. Writing in Clinical Anatomy, Dr. Philippe Charlier explores the argument that curators have ...

First live births with a novel simplified IVF procedure

2014-02-04
Cambridge, UK, February 4, 2014 - A recent prospective study published in Reproductive BioMedicine Online comparing conventional IVF with a novel simplified laboratory method of culturing embryos suggested that fertilization ...

Smokers lack motivation, feel more tired and are less active than non-smokers

2014-02-04
While the results of smoking may be expected to decrease fitness, new research, published in Respirology, has found that smokers are less physically active, lack motivation and are more likely to ...

Time to stub out misguided e-cigarette regulation

2014-02-04
Los Angeles, London (February 04, 2014). Smokers are increasingly turning to electronic cigarettes as a means to reduce the health impacts of their addiction. But legislators around the world are far from unified ...

Faces we don't forget

2014-02-04
Great eyes, full lips and harmonious features: actress Angelina Jolie is in possession of all of these. That she is regarded as ...

Teens who consume energy drinks more likely to use alcohol and drugs

2014-02-04
Philadelphia, Pa. (February 4, 2014) – Nearly one-third ...

Mouse study shows gene therapy may be possible cure for Hurler syndrome

2014-02-04
CINCINNATI – Researchers used blood platelets and bone marrow cells to deliver potentially curative gene therapy to mouse models of the human genetic disorder Hurler ...

Scientists turn primitive artificial cell into complex biological materials

2014-02-04
It is a big dream in science: To start from scratch with simple artificial microskopic building blocks and end up with something much more complex: living systemts, novel computers or every-day ...

Sun spits out mid-level solar flare

2014-02-04
The sun emitted a mid-level solar flare, beginning at 11:57 p.m. EST on Feb. 3, 2014, and peaking at midnight EST. NASA released images of the flare as captured ...

Diamond defect boosts quantum technology

2014-02-04
Washington, D.C.—New research shows that a remarkable defect in synthetic diamond produced by chemical vapor deposition allows researchers to measure, witness, and potentially manipulate electrons in a manner that could ...

LAST 30 PRESS RELEASES:

A third of licensed GPs in England not working in NHS general practice

ChatGPT “thought on the fly” when put through Ancient Greek maths puzzle

Engineers uncover why tiny particles form clusters in turbulent air

GLP-1RA drugs dramatically reduce death and cardiovascular risk in psoriasis patients

Psoriasis linked to increased risk of vision-threatening eye disease, study finds

Reprogramming obesity: New drug from Italian biotech aims to treat the underlying causes of obesity

Type 2 diabetes may accelerate development of multiple chronic diseases, particularly in the early stages, UK Biobank study suggests

Resistance training may improve nerve health, slow aging process, study shows

Common and inexpensive medicine halves the risk of recurrence in patients with colorectal cancer

SwRI-built instruments to monitor, provide advanced warning of space weather events

Breakthrough advances sodium-based battery design

New targeted radiation therapy shows near-complete response in rare sarcoma patients

Does physical frailty contribute to dementia?

Soccer headers and brain health: Study finds changes within folds of the brain

Decoding plants’ language of light

UNC Greensboro study finds ticks carrying Lyme disease moving into western NC

New implant restores blood pressure balance after spinal cord injury

New York City's medical specialist advantage may be an illusion, new NYU Tandon research shows

Could a local anesthetic that doesn’t impair motor function be within reach?

1 in 8 Italian cetacean strandings show evidence of fishery interactions, with bottlenose and striped dolphins most commonly affected, according to analysis across four decades of data and more than 5

In the wild, chimpanzees likely ingest the equivalent of several alcoholic drinks every day

Warming of 2°C intensifies Arctic carbon sink but weakens Alpine sink, study finds

Bronze and Iron Age cultures in the Middle East were committed to wine production

Indian adolescents are mostly starting their periods at an earlier age than 25 years ago

Temporary medical centers in Gaza known as "Medical Points" (MPs) treat an average of 117 people daily with only about 7 staff per MP

Rates of alcohol-induced deaths among the general population nearly doubled from 1999 to 2024

PLOS One study: In adolescent lab animals exposed to cocaine, High-Intensity Interval Training boosts aversion to the drug

Scientists identify four ways our bodies respond to COVID-19 vaccines

Stronger together: A new fusion protein boosts cancer immunotherapy

Hidden brain waves as triggers for post-seizure wandering

[Press-News.org] Finding the hidden zombie in your network
Statistical approach to unraveling computer botnets