A Distributed and Cooperative Approach to Botnet Detection Using Gossip Protocol
This addresses the acute threat of botnets for enterprises, offering a novel detection method, though it appears incremental as it builds on existing gossip protocol concepts.
The paper tackles botnet detection in enterprise networks by proposing a distributed, cooperative approach using a gossip protocol, where nodes compute and exchange suspicion values to quickly identify compromised nodes.
Bots, in recent times, have posed a major threat to enterprise networks. With the distributed nature of the way in which botnets operate, the problems faced by enterprises have become acute. A bot is a program that operates as an agent for a user and runs automated tasks over the internet, at a much higher rate than would be possible for a human alone. A collection of bots in a network, used for malicious purposes, is referred to as a botnet. In this paper we suggested a distributed, co-operative approach towards detecting botnets is a given network which is inspired by the gossip protocol. Each node in a given network runs a standalone agent that computes a suspicion value for that node after regular intervals. Each node in the network exchanges its suspicion values with every other node in the network at regular intervals. The use of gossip protocol ensures that if a node in the network is compromised, all other nodes in the network are informed about it as soon as possible. Each node also ensures that at any instance, by means of the gossip protocol, it maintains the latest suspicion values of all the other nodes in the network.