Practical Experiences of Building an IPFIX Based Open Source Botnet Detector

Mark Graham Anglia Ruskin University
Adrian Winckles Anglia Ruskin University
Erika Sanchez-Velazquez Anglia Ruskin University

DOI: https://doi.org/10.18464/cybin.v1i1.7

Abstract

The academic study of flow-based malware detection has primarily focused on NetFlow v5 and v9. In 2013 IPFIX was ratified as the flow export standard. As part of a larger project to develop protection methods for Cloud Service Providers from botnet threats, this paper considers the challenges involved in designing an open source IPFIX based botnet detection function. This paper describes how these challenges were overcome and presents an open source system built upon Xen hypervisor and Open vSwitch that is able to display botnet traffic within Cloud Service Provider-style virtualised environments. The system utilises Euler property graphs to display suspect “botnests”. The conceptual framework presented provides a vendor-neutral, real-time detection mechanism for monitoring botnet communication traffic within cloud architectures and the Internet of Things.

References

Cisco Systems NetFlow Services Export Version 9. (2004). Retrieved from http://dx.doi.org/10.17487/rfc3954

Information Model for IP Flow Information Export (IPFIX). (2013). Retrieved from http://dx.doi.org/10.17487/rfc7012

Aitken, P. (2013). Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information. Retrieved from http://dx.doi.org/10.17487/rfc7011

Collins, M. P., & Reiter, M. K. Hit-List Worm Detection and Bot Identification in Large Networks Using Protocol Graphs Lecture Notes in Computer Science (pp. 276-295): Springer Science + Business Media.

Dillon, M., & Winters, T. (2014). Virtualization of Home Network Gateways. Computer, 47(11), 62-65. doi:10.1109/mc.2014.338

Dinita, R.-I., Wilson, G., Winckles, A., Cirstea, M., & Rowsell, T. (2013). A novel autonomous management distributed system for cloud computing environments. Paper presented at the IECON 2013 - 39th Annual Conference of the IEEE Industrial Electronics Society. http://dx.doi.org/10.1109/iecon.2013.6700055

Graham, M., Winckles, A., & Sanchez-Velazquez, E. (2015). Botnet detection within cloud service provider networks using flow protocols. Paper presented at the 2015 IEEE 13th International Conference on Industrial Informatics (INDIN). http://dx.doi.org/10.1109/indin.2015.7281975

Hofstede, R., Celeda, P., Trammell, B., Drago, I., Sadre, R., Sperotto, A., & Pras, A. (2014). Flow Monitoring Explained: From Packet Capture to Data Analysis With NetFlow and IPFIX. IEEE Communications Surveys & Tutorials, 16(4), 2037-2064. doi:10.1109/comst.2014.2321898

Huang, Y.-L., Chen, B., Shih, M.-W., & Lai, C.-Y. (2012). Security Impacts of Virtualization on a Network Testbed. Paper presented at the 2012 IEEE Sixth International Conference on Software Security and Reliability. http://dx.doi.org/10.1109/sere.2012.17

Iliofotou, M., Kim, H.-c., Faloutsos, M., Mitzenmacher, M., Pappu, P., & Varghese, G. (2011). Graption: A graph-based P2P traffic classification framework for the internet backbone. Computer Networks, 55(8), 1909-1920. doi:10.1016/j.comnet.2011.01.020

Jasti, A., Shah, P., Nagaraj, R., & Pendse, R. (2010). Security in multi-tenancy cloud. Paper presented at the 44th Annual 2010 IEEE International Carnahan Conference on Security Technology. http://dx.doi.org/10.1109/ccst.2010.5678682

Lee, Y., Shin, S., Choi, S., & Son, H.-g. (2007). IPv6 Anomaly Traffic Monitoring with IPFIX. Paper presented at the Second International Conference on Internet Monitoring and Protection (ICIMP 2007). http://dx.doi.org/10.1109/icimp.2007.23

Ristenpart, T., Tromer, E., Shacham, H., & Savage, S. (2009). Hey, you, get off of my cloud. Paper presented at the Proceedings of the 16th ACM conference on Computer and communications security - CCS '09. http://dx.doi.org/10.1145/1653662.1653687

Steinberger, J., Schehlmann, L., Abt, S., & Baier, H. (2013). Anomaly Detection and Mitigation at Internet Scale: A Survey Lecture Notes in Computer Science (pp. 49-60): Springer Science + Business Media.

Trammell, B., & Boschi, E. (2008). Bidirectional Flow Export Using IP Flow Information Export (IPFIX). Retrieved from http://dx.doi.org/10.17487/rfc5103

Tsai, H.-Y., Siebenhaar, M., Miede, A., Huang, Y., & Steinmetz, R. (2012). Threat as a Service?: Virtualization's Impact on Cloud Security. IT Professional, 14(1), 32-37. doi:10.1109/mitp.2011.117

Wang, Z., & Lee, R. (2006). Covert and Side Channels Due to Processor Architecture. Paper presented at the 2006 22nd Annual Computer Security Applications Conference (ACSAC'06). http://dx.doi.org/10.1109/acsac.2006.20

Published

2016-03-07

Issue

Vol 1 No 1 (2015): Botconf 2015

Section

Conference proceedings

This work is licensed under a Creative Commons Attribution 4.0 International License.

Authors who publish with this journal agree to the following terms:

Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.