Apriori-PrefixSpan hybrid approach for automated detection of botnet coordinated attacks

Ohrui, Masayuki; Kikuchi, Hiroaki; Terada, Masato; Rosyid, Nur Rohman

doi:10.1109/NBiS.2011.23

Apriori-PrefixSpan hybrid approach for automated detection of botnet coordinated attacks

Author(s)

Ohrui, Masayuki

Kikuchi, Hiroaki

Terada, Masato

Rosyid, Nur Rohman

Date Issued

November 9, 2011

Type

Conference Paper

DOI

10.1109/NBiS.2011.23

Abstract

This paper aims to detect features of coordinated attacks by applying data mining techniques, Apriori and PrefixSpan, to the CCC DATAset 2008-2010 which consists of the captured packets data and the downloading logs. Data mining algorithms allow us to automate detecting characteristics from large amount of data, which the conventional heuristics could not apply. Apriori achives high recall but with false positive, while PrefixSpan has high precision but low recall. Hence, we propose hybriding these algorithms. Our analysis shows the change in behavior of malware over the past 3 years. © 2011 IEEE.

Citation

Proceedings 2011 International Conference on Network Based Information Systems Nbis 2011, 92-97, 2011