Detecção de botnets utilizando classificação de fluxos contínuos de dados

Abstract

The 2016 year has marked a significant paradigm shift associated with the behavior of botnets. By infecting unconventional computing devices such as home cameras and routers, the Mirai malware significantly impacted the scope and attack capacity of the botnets. This fact emphasizes the importance of developing new methods to detect botnets. One of them involves using data stream mining algorithms to classify malicious botnet traffic. Despite the existence of some initiatives that adopt this approach, several research problems remain open. An important research topic is related to the high cost and effort spent by security professionals to obtain labeled data. Therefore, the main objective of this dissertation covers the evaluation of stream mining algorithms for detecting botnets considering requirements closer to the real-world scenarios, such as i) data flows are continually arriving, ii) new botnet attacks may arise and such attacks might not be available to the decision model, iii) usually, few flows are labeled and iv) the evaluation of the classification should be done taking into account the moment when the flows arrive, in particular the ones in which new attacks arrive. Throughout the work, a series of experiments was conducted using datasets containing real traffic from different types of botnets. The experimental results show the potential of the stream mining approach for detection of botnets and reveal that it is possible to minimize the number of labeled instances presented to the classifier, maintaining a good performance.