Logo Repositorio Institucional

Please use this identifier to cite or link to this item: http://dspace.ucuenca.edu.ec/handle/123456789/42999
Full metadata record
DC FieldValueLanguage
dc.contributor.authorAstudillo Salinas, Darwin Fabian
dc.contributor.authorQuezada Pauta, Vicente Geovanny
dc.date.accessioned2023-10-03T14:13:03Z-
dc.date.available2023-10-03T14:13:03Z-
dc.date.issued2023
dc.identifier.issn1389-1286
dc.identifier.urihttp://dspace.ucuenca.edu.ec/handle/123456789/42999-
dc.identifier.urihttps://www.scopus.com/record/display.uri?eid=2-s2.0-85151397842&origin=resultslist&sort=plf-f&src=s&sid=fabc4659b4b8ab2a3a09d48deb0ba195&sot=b&sdt=b&s=TITLE-ABS-KEY%28Real-time+bot+infection+detection+system+using+DNS+fingerprinting+and+machine-learning%29&sl=101&sessionSearchId=fabc4659b4b8ab2a3a09d48deb0ba195
dc.description.abstractIn today's cyberattacks, botnets are used as an advanced technique to generate sophisticated and coordinated attacks. Infected systems connect to a command and control (C&C) server to receive commands and attack. Thus, detecting infected hosts makes it possible to protect the network's resources and prevent them from illicit activities toward third parties. This research elaborates on the design, implementation, and results of a bot infection detection system based on Domain Name System (DNS) traffic events for a network corporation. An infection detection feasibility analysis is performed by creating fingerprints. The traces are generated from a numerical analysis of 13 attributes. These attributes are obtained from the DNS logs of a DNS server. It looks for fingerprint anomalies using Isolation Forest to label a host as infected or not. In addition, on the traces cataloged as anomalous, a search will be carried out for queries to domains generated by Domain Generation Algorithms (DGA). Then, Random Forest generates a model that detects future bot infections on hosts. The devised system integrates the ELK stack and Python. This integration facilitates the management, transformation, and storage of events, generation of fingerprints, machine learning application, and analysis of fingerprint classification results with a precision greater than 99%.
dc.language.isoes_ES
dc.sourceComputer Networks
dc.subjectBot detection
dc.subjectELK stack
dc.subjectAnomaly detection
dc.subjectRandom forests
dc.subjectMachine learning
dc.subjectIsolation forests
dc.subjectDNS-based bot detection
dc.subjectBotnet
dc.titleReal-time bot infection detection system using DNS fingerprinting and machine-learning
dc.typeARTÍCULO
dc.ucuenca.idautor0103907036
dc.ucuenca.idautor0106338320
dc.identifier.doi10.1016/j.comnet.2023.109725
dc.ucuenca.versionVersión publicada
dc.ucuenca.areaconocimientounescoamplio06 - Información y Comunicación (TIC)
dc.ucuenca.afiliacionQuezada, V., Universidad de Cuenca, Cuenca, Ecuador
dc.ucuenca.afiliacionAstudillo, D., Universidad de Cuenca, Cuenca, Ecuador
dc.ucuenca.correspondenciaQuezada Pauta, Vicente Geovanny, vicente.quezada@ucuenca.edu.ec
dc.ucuenca.volumenVolume 228
dc.ucuenca.indicebibliograficoSCOPUS
dc.ucuenca.factorimpacto1.63
dc.ucuenca.cuartilQ1
dc.ucuenca.numerocitaciones0
dc.ucuenca.areaconocimientofrascatiamplio2. Ingeniería y Tecnología
dc.ucuenca.areaconocimientofrascatiespecifico2.11 Otras Ingenierias y Tecnologías
dc.ucuenca.areaconocimientofrascatidetallado2.11.2 Otras Ingenierias y Tecnologías
dc.ucuenca.areaconocimientounescoespecifico061 - Información y Comunicación (TIC)
dc.ucuenca.areaconocimientounescodetallado0613 - Software y Desarrollo y Análisis de Aplicativos
dc.ucuenca.urifuentehttps://www.sciencedirect.com/journal/computer-networks
Appears in Collections:Artículos

Files in This Item:
File SizeFormat 
documento.pdf2.36 MBAdobe PDFView/Open


This item is protected by original copyright



Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.

 

Centro de Documentacion Regional "Juan Bautista Vázquez"

Biblioteca Campus Central Biblioteca Campus Salud Biblioteca Campus Yanuncay
Av. 12 de Abril y Calle Agustín Cueva, Telf: 4051000 Ext. 1311, 1312, 1313, 1314. Horario de atención: Lunes-Viernes: 07H00-21H00. Sábados: 08H00-12H00 Av. El Paraíso 3-52, detrás del Hospital Regional "Vicente Corral Moscoso", Telf: 4051000 Ext. 3144. Horario de atención: Lunes-Viernes: 07H00-19H00 Av. 12 de Octubre y Diego de Tapia, antiguo Colegio Orientalista, Telf: 4051000 Ext. 3535 2810706 Ext. 116. Horario de atención: Lunes-Viernes: 07H30-19H00