A Reinforcement Approach for Detecting P2P Botnet Communities in Dynamic Communication Graphs

Abstract

Peer-to-peer (P2P) botnets use decentralized command and control networks that make them resilient to disruptions. The P2P botnet overlay networks manifest structures in mutual-contact graphs, also called communication graphs, formed using network traffic information. It has been shown that these structures can be detected using community detection techniques from graph theory. These previous works, however, treat the communication graphs and the P2P botnet structures as static. In reality, communication graphs are dynamic as they represent the continuously changing network traffic flows. Similarly, the P2P botnets also evolve with time, as new bots join and existing bots leave either temporarily or permanently. In this paper we address the problem of detecting such evolving P2P botnet communities in dynamic communication graphs. We propose a reinforcement-based approach, suitable for large communication graphs, that improves precision and recall of P2P botnet community detection in dynamic communication graphs.

References in corpus (5)

• Fast unfolding of communities in large networks
• Near linear time algorithm to detect community structures in large-scale networks
• Consensus clustering in complex networks
• Inferring the mesoscale structure of layered, edge-valued and time-varying networks
• PeerHunter: Detecting Peer-to-Peer Botnets through Community Behavior Analysis