Seminars & Colloquia
Georgia Institute of Technology
"Internet Malware Detection in Enterprise Networks"
Monday February 18, 2008 09:30 AM
Location: 3211, EBII NCSU Centennial Campus
(Visitor parking instructions)
In this talk, I focus on addressing the botnet detection problem in an enterprise-like network environment. I present a correlation-based framework for botnet detection that consists detection technologies already demonstrated in several systems (BotHunter, BotSniffer, BotMiner, and BotProbe). The common thread of these systems is correlation analysis (vertical correlation, horizontal correlation, and cause-effect correlation). I will mainly discuss BotHunter, BotSniffer and their corresponding correlation techniques/algorithms in this talk. These systems have been evaluated in live networks and/or real-world network traces, and the results show that they can detect real-world botnets with a very low false positive rate. These systems are starting to make an impact in the real-world. For example, there have been more than 6,000 downloads of BotHunter in the first five months after its public release. In addition, BotHunter is now being transitioned into products by several security vendors.
Host: Peng Ning, Computer Science, NCSU