A collaborative botnets suppression system based on overlay network. (26th April 2013)

• Record Type: Journal Article
• Authors: Han, Fuye; Chen, Zhen; Xu, HongFeng; Wang, Haopei; Liang, Yong
• Is Part Of: International journal of security and networks. Volume 7:Number 4(2012)
• Page Start: 211
• Page End: 219
• Publication Date: 2013-04-26
• Subjects: botnets -- botnet suppression -- overlay networks -- network security -- collaboration -- forensics -- network attacks -- botnet detection -- suppression rules; Computer networks -- Security measures -- Periodicals; 005.805
• Languages: English
• ISSNs: 1747-8405

Abstract

Botnets are extremely versatile programs used in many network attacks, such as sending large volumes of spam or launching Distributed Denial–of–Service (DDoS) attacks. Botnets can switch command–and–control servers automatically, which makes completely suppressing botnets very challenging. In this paper, we present a collaborative botnet suppression system based on an overlay network, with one control center node and several suppression nodes. The suppression nodes automatically collect network traffic information and deploy suppression rules; the control center node gathers all collected data, and processes this data by using a botnet detection algorithm. Once botnets are detected, the control center node generates and distributes suppression rules. In order to prevent an excessive growth of the rules set, the system automatically identifies and removes invalid rules through an efficient feedback mechanism.