An Integrated Approach for Botnet Detection and Prediction Using Honeynet and Socialnet Data

Abstract

In today’s online and digital world with Internet being a necessity, botnets pose a greater threat to Internet because of its distributed nature and the fact that it can use any unpatched machine from computer to any connected device such as IoT devices. Botnets are now used as a mechanism for carrying out a vast variety of cyber threats such as conducting DDos, phishing attacks, and generating and distributing malwares such as ransomwares. Botnets are generally detected using passive monitoring techniques such as honeypots. In this paper, a new method is proposed for detecting the botnets on the basis of the data acquired from the honeynet and social networks. The honeynet provides us with network traffic data while the social networks provide us with events that might correlate with the attacks detected for characterizing and detecting botnets. Our work focuses on proactive botnet detection using the honeynet data. For implementation, local honeynets have been deployed. The attack data is preprocessed for feature extraction. For each attack location, time components such as country, state, city, date, day, and time information are derived and added to the feature set. Further, for a given duration and location, the socialnet is explored and key information, events, activities, and news details are extracted. These are appended as new attributes, thus producing an augmented transaction database. The data set obtained from the honeynets is used for the detection of botnets by the means of correlation and similarity while association rule mining techniques help in predicting a botnet attack.