![](https://csdnimg.cn/release/download_crawler_static/15691443/bg4.jpg)
Qiao et al. / J Zhejiang Univ-Sci C (Comput & Electron) 2013 14(9):682-700
685
However, the definition of the dense fragment set in
Sheng et al. (2006) is not suitable for a fast mining
algorithm, since its length is not a multiple of the
period.
3 P2P botnet detection model: DMRP
3.1 Motivation
P2P bots periodically search nodes to refresh
their local peer lists and to receive the latest com-
mands from their botmaster. This is due to the basic
demands of the P2P structure and the pre-programmed
behavior of bots. Meanwhile, P2P botnets always
employ Kademlia-like protocols to construct their
own C&C protocols just like popular P2P applications
such as eMule (http://www.emule-project.net/) and
BitTorrent (http://www.bittorrent.com/). In Kademlia
(Maymounkov and Mazieres, 2002), the self-updating
mechanism maintains the valid status of applications
by periodically sending node search requests to up-
date their node lists in order to obtain closer and more
stable neighbors. In P2P botnets, similarly, bots pe-
riodically send node search requests to obtain updated
commands and neighbors. This phenomenon suggests
that if we can capture the specific periodic behaviors
in traffic and distinguish them from other activities or
other periodic behaviors, we will be able to detect P2P
bots.
According to the above analysis, we propose a
P2P botnet traffic detection method by mining the
regional periodic patterns. ‘Regional’ indicates that
the periodic pattern might exist only within a limited
range rather than in the whole time series. A formu-
lated definition of regional periodic pattern will be
given Section 4.
Mining potential regional periodic patterns from
the time series of traffic features alone is not enough
for P2P bot detection. The existence of periodic pat-
terns is not a sufficient condition for the presence of
P2P bot traffic, as normal P2P applications and some
other network applications may also trigger periodic
behavior. Therefore, further steps are needed. In this
paper, we introduce an evaluation function to score
these mined patterns in order to recognize the P2P bot
traffic.
3.2 Detection model
As illustrated in Fig. 1, our P2P bot detection
model DMRP (detection by mining regional perio-
dicity) is composed of three major components: time
series extraction, regional periodic pattern mining,
and evaluation of traffic.
The workflow of DMRP can be summarized as
follows:
1. In the time series extraction phase, to reduce
redundant and noisy packets, only suspicious traffic
will be retained and then classified by internal hosts’
IP addresses. For each IP’s traffic, a time series of
traffic features will be extracted. At last, based on our
later definition of event types, the feature time series
will be transformed into an event time series.
2. In the second phase, for an event time series,
the circular autocorrelation function is first used to
search for candidate periods. Then, as the most im-
portant step in our model, we need to recognize re-
gional periodic patterns from current time series
based on the candidate periods.
3. In the final phase, the mined regional patterns
will be evaluated by an evaluation function. Detection
results of P2P bots are determined given the scores of
corresponding periodic patterns.
In Section 3.3 we will describe the time series
extraction method. The latter two phases about re-
gional periodic pattern mining and the evaluation
process will be explained in detail in Sections 4 and 5,
respectively.
3.3 Time series extraction
As shown in Fig. 1, the first module of DMRP
includes five steps:
Fig. 1 P2P bot detection model: DMRP (detection by
mining regional periodicity)
Capture suspicious
network traffic
Traffic filtering
Classify traffic by
host IPs
Obtain feature
time series
Time series
abstraction
Search probable
periods
Mine regional
periodic patterns
Regional periodic
pattern mining
Evaluation
function
Evaluation
of traffic
Three
algorithms
P 2P bot
detection
Obtain event time series