Botnet traffic detection using hidden Markov models

We develop a novel approach to detect botnet traffic using hidden Markov models (HMMs). Botnets are becoming a major source of spam, distributed denial-of-service attacks (DDoS) and other cybercrime [21]. Analogs to botnets are likely to become threats to supervisory control and data acquisition (SCADA) and smart grid systems [19]. Malware that spies on and subverts SCADA systems or their SCADA analogs has been found recently [4]. More sabotage and cyberattacks are expected on the energy infrastructure [2], [3]. Attack detection on energy infrastructure is important. In this work, we detect node corruption by the largest botnet in the wild, Zeus. In Zeus, bots are controlled by attackers under a centralized command and control (C&C) infrastructure. We infer hidden Markov models from Zeus botnet traffic timing data. Inter-packet timings are due to botnet behaviors and C&C communication patterns among bots are usually similar. Inferred HMMs detect the botnet communication traffic. Experiment results on real-world traffic data show that this approach accurately differentiates between botnet traffic and normal traffic.