Downloads & Free Reading Options - Results

Software defined networks (SDNs) is one of the most emerging field and will cause revolution in the Information Technology (IT) industry. The flexibility in the SDNs make it most attractive technology to adopt in all type of networks. This flexibility in the network made the SDNs more prone to the security issues so it is important to cater these issues in start from the SDN design up-to the deployment and operations. This Paper proposed a DNS based approach to prevent SDNs from botnet by applying one million web database concept without reading packet payload. To do any activity, Bot need to communicate with CnC and requires DNS to IP resolution. For any request having destination port 53 (DNS) will be checked. The protocol will get all matching traffic and will send it to 1Mdb. If URL Exists in 1Mdb then do not respond otherwise send reply with remove flow and block flow to the controller. This approach will use Machine learning algorithms to classify the traffic as BOT or normal traffic. Naive Bayes Classifier is used to classify the data using python programming language. The selection of dataset is very important task for machine learning based botnet detection and prevention techniques. The poor selection of dataset possibly lead to biased results. The real world and publically available dataset is a good choice for evaluation of botnet detection techniques. To meet these criteria, publicly available CTU-43 botnet dataset has been used. This dataset provide packet dumps (pcap files) of seven real botnets (Neris, Rbot, Virut, Murlo, Menti, Sogou, and NSIS). We will use these files to generate botnet traffic for evaluation and test our model. To generate normal traffic, we selected ISOT dataset. This dataset provides a single pcap file having normal traffic and traffic for weladec and zeus botnet.