EFFORT: Efficient and Effective Bot Malware Detection Conference Paper uri icon

abstract

  • To detect bots, a lot of detection approaches have been proposed at host or network level so far and both approaches have clear advantages and disadvantages. In this paper, we propose EFFORT, a new host-network cooperated detection framework attempting to overcome shortcomings of both approaches while still keeping both advantages, i.e., effectiveness and efficiency. Based on intrinsic characteristics of bots, we propose a multi-module approach to correlate information from different host- and network-level aspects and design a multi-layered architecture to efficiently coordinate modules to perform heavy monitoring only when necessary. We have implemented our proposed system and evaluated on real-world benign and malicious programs running on several diverse real-life office and home machines for several days. The final results show that our system can detect all 15 real-world bots (e.g., Waledac, Storm) with low false positives (0.68%) and with minimal overhead. We believe EFFORT raises a higher bar and this host-network cooperated design represents a timely effort and a right direction in the malware battle. 2012 IEEE.

name of conference

  • 2012 Proceedings IEEE INFOCOM

published proceedings

  • 2012 Proceedings IEEE INFOCOM

altmetric score

  • 3

author list (cited authors)

  • Shin, S., Xu, Z., & Gu, G.

citation count

  • 40

complete list of authors

  • Shin, Seungwon||Xu, Zhaoyan||Gu, Guofei

publication date

  • January 2012