Authors:
M. Lisa Mathews
;
Anupam Joshi
and
Tim Finin
Affiliation:
University of Maryland, United States
Keyword(s):
Intrusion Detection, Situational-aware, Botnet Detection.
Related
Ontology
Subjects/Areas/Topics:
Internet Technology
;
Intrusion Detection and Response
;
Web Information Systems and Technologies
Abstract:
Botnet attacks turn susceptible victim computers into bots that perform various malicious activities while
under the control of a botmaster. Some examples of the damage they cause include denial of service, click
fraud, spamware, and phishing. These attacks can vary in the type of architecture and communication protocol
used, which might be modified during the botnet lifespan. Intrusion detection and prevention systems are
one way to safeguard the cyber-physical systems we use, but they have difficulty detecting new or modified
attacks, including botnets. Only known attacks whose signatures have been identified and stored in some form
can be discovered by most of these systems. Also, traditional IDPSs are point-based solutions incapable of
utilizing information from multiple data sources and have difficulty discovering new or more complex attacks.
To address these issues, we are developing a semantic approach to intrusion detection that uses a variety of
sensors collaboratively. Leve
raging information from these heterogeneous sources leads to a more robust,
situational-aware IDPS that is better equipped to detect complicated attacks such as botnets.
(More)