Private:progress-alkurbi

Spring 2011

• Courses: None
• Research: Developing Online SIP-Botnet Detection System

• Progress Report: Please read "Progress" section here

March 01

• Incremental mode has been implemented and tested. The results show 65%~94% reduction of execution time.
• Previous set of comments have been applied.

Feb 15

• All figures on the report are on eps format.
• I implemented and tested "`Tracking IP-flows"' instead of SIP sessions (To avoid the need to the application layer content which could be encrypted). I ran number of experiments, which showed unstable precision (low, mild, high, very high FP/FN), so I discard it.
• In order to improve the performance of calculating the similarity between two users from $O(N^2)$ into O(N), I redesigned the correlation\&detection engine to insert sessions in the order of their lengths, then implemented 3 types of similarity/distance algorithms: Cosine Similarity, Normalized Euclidean distance, and Canberra distance. Sessions are inserted in order so that we can eliminate the session time factor. The experiments showed that I could not find a threshold value that would minimize both FP/FN to the minimum.
• I almost implement incremental processing mode to improve the performance, so instead of processing the whole data within a time window, over again at every sliding window, I tried to take advantage of what has been built from the previous time window, and integrate only those new users/sessions in the new sliding time window into it. Next is to test the code, and I'm sure that it will need quite refinements.

Feb 08

• Rewrite the experiments and evaluation results in a formal manner under "`Experimental Evaluation"' chapter. (Done)
• Implementing \& Testing Identifying Sip-Botnet controllers. (Done)
• Implementing and testing Online Mode. (Done)

Feb 01

• Evaluation according to the plan (Large Scale Evaluation & Documentation) is complete, as following:
  • Generated Traffics have been checked.
  • Alpha & Beta has been tuned.
  • Different traffic have been generated for different number of bots [10, 50, 100].
  • FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.
  • Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].
  • A total of 34 figures have been plotted and included in the report.
  • The attached report has all the update.

Jan 24

• Works (Large Scale Evaluation & Documentation):
  • Generated 24h SIP traffic with "1000" users, "10" bots.
  • Tuned Alpha & Beta values.
  • Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.
  • Exporting statistics reports into Matlab and generating figures.