"Internet Malware: Rising Threats and New Detection Techniques" by Dr. Guofei Gu

Date: December 4, 2008
Time: 1:30 pm – 2:30 pm

Where: SB 4.01.20 (CS conference room)

"Internet Malware: Rising Threats and New Detection Techniques"
by Dr. Guofei Gu (Texas A&M University)


Most of the attacks and fraudulent activities on the Internet are carried by malware. In particular, botnets have become the primary "platforms" for attacks on the Internet. A botnet is a network of compromised computers (or, bots) that are under the control of an attacker (or, botmaster). A botnet typically has tens to hundreds of thousands of bots, but some had several millions of bots. Botnets are now used for distributed denial-of-service attacks, spam, phishing, information theft, etc. With the magnitude and the potency of attacks afforded by their combined bandwidth and processing power, botnets are now considered as the largest threat to Internet security.

In this talk, I focus on addressing the botnet detection problem in an enterprise-like network environment. I present a correlation-based framework for botnet detection that consists of detection technologies already demonstrated in several systems (BotHunter, BotSniffer, BotMiner, andBotProbe). The common thread of these systems is correlation analysis (vertical correlation, horizontal correlation, and cause-effectcorrelation). I will mainly discuss BotHunter, BotSniffer and their corresponding correlation techniques/algorithms in this talk. These systems have been evaluated in live networks and/or real-world network traces, and the results show that they can detect real-world botnets with a very low false positive rate.


Dr. Guofei Gu is an assistant professor in the Department of Computer Science at Texas A&M University. Before coming to Texas A&M, he received his Ph.D.degree in Computer Science from the College of Computing, Georgia Tech, in 2008. His research interests are in network and system security; specifically intrusion detection, web security, and malware detection, defense and analysis. Further information is available at http://faculty.cs.tamu.edu/guofei.