A Combined Fusion and Data Mining Framework for the Detection of Botnets

Abstract

This paper describes a combined fusion and miningframework applied to the detection of stealthy botnets.The framework leverages a fusion engine thattracks hosts through the use of feature-based profilesgenerated from multiple network sensor types. Theseprofiles are classified and correlated based on a setof known host profiles, e.g., web servers, mail servers,and bot behavioral characteristics. A mining enginediscovers emergent threat profiles and delivers themto the fusion engine for processing. We describe thedistributed nature of botnets and how they are createdand managed. We then describe a combined fusion andmining model that builds on recent work in the cybersecurity domain. The framework we present employsan adaptive fusion system driven by a mining systemfocused on the discovery of new threats. We concludewith a discussion of experimental results, deploymentissues, and a summary of our arguments.