Botnet Detection Algorithms

This paper proposes an improved detection algorithm for LTE Random Access preamble detection and evaluates the performance of the algorithm with respect to the performance of algorithms proposed in the literature using MDP metric. Keywords— detection algorithm; LTE; Random access; preamble; MDP I. INTRODUCTION The 3 rd Generation Partnership Project (3GPP) mandates a certain access procedure for achieving synchronization between the evolved base station (eNodeB) and the mobile User Equipment (UE) in the Long Term Evolution (LTE) Standard. This Access Procedure consists of three parts, cell search which enables the UE to assess the reception quality of the current and neighbouring cells so as to conclude if a handover is necessary; transfer of system information; and Random Access. A detailed description of this access procedure is discussed in the standard [1][2][3].This Random Access procedure consists of four steps executed by the UE and eNodeB [5] that helps the network identify the UE and establish timing synchronization [Fig. 1]. The following are the four steps of Random Access, Step 1: The UE selects one of the 64 available preambles generated from a root sequence and transmits it to the eNodeB. This preamble identifies the UE and provides Timing Advance (TA) information to the network. Step 2: The eNodeB replies with a Random access response message that consists of a temporary identity assigned to the UE, TA information and Uplink Grant resource. Step 3: The UE transmits a Terminal Identification message based on the temporary identity received in the previous step as part of Radio Resource Control (RRC) signaling. Step 4: The eNodeB replies with a contention resolution message completing the RRC signaling between the network and the UE.

Botnets have in recent times, become a very major challenge in the cyberspace. The Global Internet has experienced tremendous attacks designed mainly to disable internet infrastructure on one hand, while in most other cases people and organizations are targeted. At the center of these attacks are a group of compromised computers that have been infested and are now controlled by a Botmaster. These systems are usually located in schools, business premises, homes and government agencies which, unknown to their owners, are infested and controlled by Botmasters for malicious activities. This paper presents an analysis of Botnet with respect to its architectural representation, classification and characterization in order to help coordinate the development of new technologies to face this serious security threat. Index Terms-Peer to Peer (P2P), Botnet, Command and Control Channel (C&C), Botnet Detection, Cyber Security 1.0. INTRODUCTION The word Botnet, is a combination of the words robot and network. It is used to describe a group of compromised computer systems that are usually connected to a central controller called a Botmaster. The Botmaster uses command and control (C&C) channels, to manipulate these infested computers. A single infested system is known as a bot, while a network of infested devices is referred to as a Botnet. Botnets are created by the Botmaster for communication infrastructure to perform malicious activities like spamming, click fraud, identity theft, phishing attacks and distributed denial of service attacks. Characterizing existing Botnets will help to coordinate and develop new technologies to face this serious security threat. Systems that are connected to the internet have the chances of getting infested and become part of a Botnet. Several Researchers like [1], [2], [3] amongst others, have worked extensively on Botnets with respect to its classification and functionalities. According to [4] Botnets can be classified according to their attacking behavior, command and control (C&C) mechanism, rallying mechanisms, communication protocols, evasion techniques and other activities such as abnormal system calls and traceable DNS queries. [5], in their survey of the categories of Botnets, noted that Botnets can be classified into six basic types based on the C&C channel used. These include, according to them, IRC (Internet Relay Chat) Botnet, P2P (Peer-to-Peer) Botnet, HTTP (Hyper Text Transfer Protocol) Botnet, Mobile Botnet, Cloud Botnet and the hybrid Botnet which according to them, is the combination of all the types of Botnet Structures. These Botnets can be grouped into two categories, and these include, the Centralized Botnets and the Decentralized Botnets. I. Centralized Botnets Architecture Centralized Botnets usually have a centralized network topology. They consist of a Command and Control (C&C) server that a Botmaster uses to send commands to their bots. A Botmaster will issue a command by posting a message to this channel. The C&C server pushes the command to bots which then invoke the command with a relatively low latency. As long as the infested machine is on and has an active Internet connection, it will remain connected to the C&C server awaiting commands. In the survey presented by [6], they noted that the centralized Botnets are similar to a client server model. All the bots act as clients and connect to the centralized servers. The servers initiate commands to these bots which are connected to it. In the centralized Botnet architecture, the Botmaster can monitor all the bots and receive direct and accurate feedback along with the status of the Botnet. This tallied with the work of [7], where they noted that, the centralized Botnet, has one center point that is accountable for exchanging commands and malicious data between the Botmaster and Bots. They also recorded that in this centralized model, the Botmaster chooses a host which is usually a high bandwidth computer, to be the central point which will be the Command-and-Control server of all the Bots. Centralised Botnets belong to the first generation of Botnets where the Botmaster controls the bots through a single C&C server at a single point in form of a star topology. According to [8], three types of centralized Botnets architecture exit and these include the Internet Relay Chat (IRC) Botnets, Internet Messaging (IM) Based Botnets and the Hypertext Transfer Protocol (HTTP) Based Botnet architecture. II. Internet Relay Chat (IRC) Botnets Internet Relay Chat (IRC) is a text-based chat-system that organizes communication in channels. According to the survey done by [5], the Botmaster exploits the Internet Relay Chat (IRC) as the C&C Channel to communicate and control the bots. Also, [8]recorded that IRC is an on-line text-based instant messaging protocol that works on client-server architecture. They further stated that IRC is capable of connecting hundreds of clients through multiple servers, and that clients can be contacted using one