Using Network Forensics and Artificial Intelligence Techniques to Detect Bot-nets on an Organizational Network

Abstract

Malicious software often infects a corporate network by exploiting security holes in web browsers to infiltrate a PC when its user visits a dodgy website. Compromised machines can then be linked up to form “Bot-nets” under external control, which are used to send spam e-mails or disable websites with a flood of bogus requests. This Paper looks at identity concealment techniques and Bot-net characteristics followed by an introduction to the concept of network forensics. The paper then proposes the use of computational intelligence techniques to detect Bot-nets. We then simulate anomaly detection in the next section followed by an interpretation of the simulated results in the following section. Followed by a section describing future work, the paper then concludes by discussing how the system would be tested on an organizational network.