Botnet detection system and method
AssigneeNtt Innovation Institute, Inc.
InventorsMasayuki Inoue, Satoshi Iitsuka, Yuhei Kawakoya
Life of this patent
Estimating the term…
Abstract
A system and method are provided for detecting a botnet in a network based on traffic flow, daisy chained mechanism and white-list generation mechanism. The system and method uses the known malicious components in a botnet such as IP address, domain name and URL, to be the root of a daisy chain and creates a network graph based on given traffic flow data such as NetFlow data, DNS cache data, DNS sinkhole data, DDoS data and Attack log data in threat sensors. The system and method iteratively detects new malicious factors by tracing that network graph. The system and method also introduces a technique to create a white list which is used in the daisy chain to reduce false positive.
Claims16
A botnet detection system, comprising:
- a network having one or more nodes and one or more command and control devices coupled to each other;
- a storage device having a plurality of pieces of data about the network including a plurality of internet protocol addresses corresponding to one or more nodes, one or more command and control devices and at least one known botnet and network traffic flow data indicating a communication between one of at least one node and at least one command and a communication and at least one known botnet;
- and
- a botnet detection component coupled to the storage device, the botnet detection component detecting, using the network traffic pattern data, a new botnet.
A botnet detection method, the method comprising:
- obtaining a plurality of pieces of data about a network having one or more nodes and one or more command and control devices, the plurality of pieces of data comprising a plurality of internet protocol addresses corresponding to one or more nodes, one or more command and control devices and at least one known botnet and network traffic flow data indicating a communication between one of at least one node and at least one command and a communication and at least one known botnet;
- and
- detecting, using the network traffic flow data, a new botnet.
Dependencies are inferred from the claim text.