Characterizing Botnet In P2P Network For UDP Protocol

Noor Zuraidin, Mohd Safar (2011) Characterizing Botnet In P2P Network For UDP Protocol. Masters thesis, UTeM.

	PDF (Full Text) Characterizing_Botnet_In_P2P_Network_For_UDP_Protocol_Full_Text.pdf - Submitted Version Restricted to Registered users only Download (8MB)
	PDF (24 Pages) Characterizing_Botnet_In_P2P_Network_For_UDP_Protocol_24_Pages.pdf - Submitted Version Download (546kB)

Abstract

In modem society, an extensive range of business, infrastructure, and human needs, such as communications, utilities, banks, and leisure services are now provided by systems that rely on the secure and efficient operation of computer networks. As networks increase in size and complexity, a thorough understanding of their behavior is crucial to protect them from security threats. One of the threats to the network today is the threat of Botnet. This study will carry out the characterizing botnet in computer networks. In the beginning of the study, botnet architecture, behaviour, topology and mechanism are discussed. To analyze the characteristic, behaviour or pattern of the botnet base on the network traffic, a proper network analyzing tools is needed. Several network analysis tools available today are use for the analysis process of the network traffic. In the analysis phase, the botnet detection strategies base on the signature and DNS anomaly approach are selected to identify the behaviour and the characteristic of the botnet. In anomaly approach most of the behavioral and characteristic identification of the botnet is done by comparing between the normal and abnormal traffic. The main focus of the network analysis is studied on UDP protocol network traffic. Based on the analysis of the network traffic, the following anomalies are identified, abnormal DNS packet request, the NetBIOS attack, abnormal DNS MX query, DNS amplification attack and UDP flood attack. During the analysis process, the irregularity of the network traffic behaviour shows the characteristic of the botnet are existed in the network. The identified characteristic of the botnet can be used for future detection tools and mitigation of the botnet.

Item Type:	Thesis (Masters)
Uncontrolled Keywords:	Peer-to-peer architecture (Computer networks)
Subjects:	T Technology > T Technology (General) T Technology > TK Electrical engineering. Electronics Nuclear engineering
Divisions:	Faculty of Information and Communication Technology > Department of Industrial Computing
Depositing User:	Azman Amir
Date Deposited:	05 Apr 2013 08:21
Last Modified:	28 May 2015 03:46
URI:	http://eprints.utem.edu.my/id/eprint/7072
Statistic Details:	View Download Statistic

Actions (login required)

View Item