(Press-News.org) Contact information: Albert Ang
press@inderscience.com
Inderscience Publishers
Finding the hidden zombie in your network
Statistical approach to unraveling computer botnets
How do you detect a "botnet", a network of computers infected with malware -so-called zombies - that allow a third party to take control of those machines? The answer may lie in a statistical tool first published in 1966 and brought into the digital age researchers writing this month in the International Journal of Electronic Security and Digital Forensics.
Millions of computers across the globe are infected with malware, despite the best efforts of public awareness campaigns about phishing attacks and antivirus software. Much of the infection is directed towards allowing a third party to take control of a given machine or indeed a network of machines and exploiting them unbeknownst the legitimate users in malicious and criminal activity. Security and software companies do monitor internet activity and there have been many well-publicized successes in destroying such botnets. However, malware writers are always developing new tools and techniques that allow them to infect unprotected computers and rebuild botnets.
Botnets are widely used in organized crime to attempt breaches on security systems by mounting distributed denial of service (dDOS) attacks, among other techniques, on corporate, banking and government systems. Such attacks can open up "backdoors" into a private computer network that lets the botnet controller access proprietary and other sensitive information, passwords or even voting systems. Botnets have also been used for simply malicious purposes to force websites and other services offline, occasionally in an act of protest or rebellion.
Now, R. Anitha and colleagues at PSG College of Technology, Coimbatore, India, have turned to a statistical tool known as the hidden semi-Markov model (HsMM) to help them develop monitoring software that can detect the telltale signs of botnet activity on a computer and so disable the offending malware. In probability theory and statistics, a Markov process is one in which someone can predict the next state of a process based on its current state without knowing the full history of the process. An example in gambling would be that if you have chip now and the odds of winning or losing on the next bet are even then we can predict without knowing how many chips you had earlier that you will either have none or two after the next bet.
A hidden-Markov model would thus include variables of which the observer has no sight but can infer and so predict an outcome. Predicting whether it rained on a given day based on whether a fair-weather-only walker was out on a given day without you having a weather report for their area involves a hidden-Markov process. A hidden semi-Markov model then involves a process of this sort but where the time-elapsed into the current state affects the prediction. For example, one might predict the rainfall pattern based on how long it is since our fair-weather walk last ventured out.
The team has applied the statistical logic of the hidden semi-Markov model to forecast the characteristics of internet activity on a given computer suspected of being a "zombie computer" in a botnet based on management information base (MIB) variables. These variables are the components used to control the flow of data packets in and out of the computer via the internet protocol. Their approach can model the "normal" behavior and then highlight botnet activity as being a deviation from the normal without the specific variables that are altered by the malware being in plain sight.
The team points out that botnet and malware developers have focused recently on web-based, http, type activity, which is easier to disguise among the myriad packets of data moving to and fro across a network and in and out of a particular computer. Their tests on a small zombie computer network shows that the hidden semi-Markov model they have developed as a lightweight and real-time detection system can see through this disguise easily. If implemented widely such as system could lock down this kind of botnet very quickly and slow the assimilation of zombie computers by criminals and others with malicious intent.
###
"HTTP botnet detection using hidden semi-Markov model with SNMP MIB variables" in Int. J. Electronic Security and Digital Forensics, 2014, 5, 188-200.
Finding the hidden zombie in your network
Statistical approach to unraveling computer botnets
2014-02-04
ELSE PRESS RELEASES FROM THIS DATE:
Who owns the bones? Should bodies in museum exhibits be returned home?
2014-02-04
From Egyptian mummies to Ötzi the Iceman, human remains are a common, if macabre, feature of museum exhibits. Writing in Clinical Anatomy, Dr. Philippe Charlier explores the argument that curators have ...
First live births with a novel simplified IVF procedure
2014-02-04
Cambridge, UK, February 4, 2014 - A recent prospective study published in Reproductive BioMedicine Online comparing conventional IVF with a novel simplified laboratory method of culturing embryos suggested that fertilization ...
Smokers lack motivation, feel more tired and are less active than non-smokers
2014-02-04
While the results of smoking may be expected to decrease fitness, new research, published in Respirology, has found that smokers are less physically active, lack motivation and are more likely to ...
Time to stub out misguided e-cigarette regulation
2014-02-04
Los Angeles, London (February 04, 2014). Smokers are increasingly turning to electronic cigarettes as a means to reduce the health impacts of their addiction. But legislators around the world are far from unified ...
Faces we don't forget
2014-02-04
Great eyes, full lips and harmonious features: actress Angelina Jolie is in possession of all of these. That she is regarded as ...
Teens who consume energy drinks more likely to use alcohol and drugs
2014-02-04
Philadelphia, Pa. (February 4, 2014) – Nearly one-third ...
Mouse study shows gene therapy may be possible cure for Hurler syndrome
2014-02-04
CINCINNATI – Researchers used blood platelets and bone marrow cells to deliver potentially curative gene therapy to mouse models of the human genetic disorder Hurler ...
Scientists turn primitive artificial cell into complex biological materials
2014-02-04
It is a big dream in science: To start from scratch with simple artificial microskopic building blocks and end up with something much more complex: living systemts, novel computers or every-day ...
Sun spits out mid-level solar flare
2014-02-04
The sun emitted a mid-level solar flare, beginning at 11:57 p.m. EST on Feb. 3, 2014, and peaking at midnight EST. NASA released images of the flare as captured ...
Diamond defect boosts quantum technology
2014-02-04
Washington, D.C.—New research shows that a remarkable defect in synthetic diamond produced by chemical vapor deposition allows researchers to measure, witness, and potentially manipulate electrons in a manner that could ...
LAST 30 PRESS RELEASES:
Scientists trace origins of now extinct plant population from volcanically active Nishinoshima
AI algorithm based on routine mammogram + age can predict women’s major cardiovascular disease risk
New hurdle seen to prostate screening: primary-care docs
MSU researchers explore how virtual sports aid mental health
Working together, cells extend their senses
Cheese fungi help unlock secrets of evolution
Researchers find brain region that fuels compulsive drinking
Mental health effects of exposure to firearm violence persist long after direct exposure
Research identifies immune response that controls Oropouche infection and prevents neurological damage
University of Cincinnati, Kent State University awarded $3M by NSF to share research resources
Ancient DNA reveals deeply complex Mastodon family and repeated migrations driven by climate change
Measuring the quantum W state
Researchers find a way to use antibodies to direct T cells to kill Cytomegalovirus-infected cells
Engineers create mini microscope for real-time brain imaging
Funding for training and research in biological complexity
The Journal of Nuclear Medicine Ahead-of-Print Tip Sheet: September 12, 2025
ISSCR statement on the scientific and therapeutic value of human fetal tissue research
Novel PET tracer detects synaptic changes in spinal cord and brain after spinal cord injury
Wiley advances Knowitall Solutions with new trendfinder application for user-friendly chemometric analysis and additional enhancements to analytical workflows
Benchmark study tracks trends in dog behavior
OpenAI, DeepSeek, and Google vary widely in identifying hate speech
Research spotlight: Study identifies a surprising new treatment target for chronic limb threatening ischemia
Childhood loneliness and cognitive decline and dementia risk in middle-aged and older adults
Parental diseases of despair and suicidal events in their children
Acupuncture for chronic low back pain in older adults
Acupuncture treatment improves disabling effects of chronic low back pain in older adults
How interstellar objects similar to 3I/ATLAS could jump-start planet formation around infant stars
Rented e-bicycles more dangerous than e-scooters in cities
Ditches as waterways: Managing ‘ditch-scapes’ to strengthen communities and the environment
In-situ molecular passivation enables pure-blue perovskite LEDs via vacuum thermal evaporation
[Press-News.org] Finding the hidden zombie in your networkStatistical approach to unraveling computer botnets