Time Zone Analysis on IIJ Network Traffic for Malicious Botnet Activities

スポンサーリンク

概要

• 論文の詳細を見る

• Many of recent cyber-attacks are being lunched by botnets for the purpose of carrying out large scale cyber-attacks such as DDoS, spam email, network scanning, and so on. In many cases, these botnets consist of a lot of bots or compromised PCs, which have been infected by specific malware. These bots try to propagate themselves into other victim via the multiple C&C servers in the Internet, which are controlled by a remote botmaster. This makes it more difficult to identify botnet attacks and harder to trace the source country/IP address of the botmaster. To identify the C&C servers during malware/bot downloading phase, time zone correlation can be used as a tool to identify the time zone of the C&C servers. In this paper, we do a time zone correlation analysis with the malware download up to 100 honeypots in the IIJ MITF (Internet Ini-tiative Japan - Malware Investigation Task Force) Dataset 2012 comprising over 30 million data records and almost 5 hundreds unique malware names. Baesd on GeoIP service, a time zone correlation model has been proposed to determine the correlation coefficient between malware dwnloads from Japan and other countries. We found a strong correlation between ac-tive bot downloads and time zone of the C&C servers. As a result, our model confirmts that malware/bot downloads are synchronized with time zone (country) of the corresponding C&C servers.

• 一般社団法人電子情報通信学会の論文
• 2013-07-11

著者

• ISHII Hiroshi

  The author is with NTT Information Sharing Platform Labs.

• TERADA Masato

  The authors is with the Hitachi, Ltd., Japan.

• SISAAT Khamphao

  The authors are with the Faculty of Engineering, King Mongkut's Institute of Technology Ladkrabang, Thailand.

• KIKUCHI Hiroaki

  The author is with the School of Interdisciplinary Mathemat-ical Sciences, Meiji University, Japan.

• KITTITORNKUN Surin

  The authors are with the Faculty of Engineering, King Mongkut's Institute of Technology Ladkrabang, Thailand.

• YUKONHIATOU Chaxiong

  The authors are with the Faculty of Engineering, King Mongkut's Institute of Technology Ladkrabang, Thailand.

関連論文

• Data-Driven Implementation of Highly Efficient TCP/IP Handler to Access the TINA Network
• Time Zone Analysis on IIJ Network Traffic for Malicious Botnet Activities
• Time Zone Analysis on IIJ Network Traffic for Malicious Botnet Activities
• Time Zone Analysis on IIJ Network Traffic for Malicious Botnet Activities

スポンサーリンク