This blog post was originally published on 12 October 2015, by Sebastian Garcia, at https://stratosphereips.org/ccdetector-and-botnetdetectorcomparer.html.
Some days ago we finally made public two tools that were very important for starting this project. The tools are CCDetector and BotnetDetectorComparer. With these tools we created the experiments in the paper “An empirical comparison of botnet detection methods”. You can download them and use them to verify the paper and test more ideas. Please contact us if you need assistance.
A machine learning based detector of Command and Control channels in malware and botnet traffic. See please www.researchgate.net/profile/Sebastian_Garcia6 It uses an implementation of Markov Chains to model the state transitions of the traffic according to a model and detect similar behavioral traffic in other binetflow files.
It can also read binetflow files in real time from the network and print a nice ncurses interface with the states.
You should give it a labeled netflow text file with -f (generated by Argus) and use -r. See the example file for details. This will generate a MCModels folder full of the markov chain models for the tuples in the file.
After training the models with some file. Use -f to give a labeled binetflow file and use -e. Without any other option, a new file will be generated with the original binetflow information and an additional column with the predicted label based on the trained models. Also a sorted version of the binetflow file is created. No input is printed in the console.
Verification and performance metrics
To verify the results and know the performance metrics you should use another program called BotnetDetectorsComparer (https://bitbucket.org/eldraco2000/botnetdetectorscomparer) With this program you do:
BotnetDetectorsComparer.py -f <binetflowfile>.labeled.sorted -t weight -T 300 -a 0.01
And find out the performance metrics according to a time window and weighted logic. Please see the papers.
0.90 This is the first public version. Any problem please contact firstname.lastname@example.org or email@example.com
This is a program to compare different botnet/malware detectors based on network traffic. The idea is to read a netflow file that has a new column for each prediction of an algorithm and compare how each algorithm detects the traffic. It computes the FP, FN, TP and TN for each flow in a time window, by counting the errors per IP address. At the end of each time window several performance metrics are compared, and also at the end of the capture.
To use it you should give a binetflow file, the type of comparison and the width of the time window.
./BotnetDetectorsComparer.py -f statisticGenerator.testcasewithheaders9.txt -t weight -T 300
Giving an alpha is also a good idea, if not the program will assume a default of 0.01 (like in our experiments)
With -p it will plot and open a window with the graph information for each method. With -P it will store the plots on disk. (format is in the help, but can by almost anything like png)
Any problem contact firstname.lastname@example.org or email@example.com