Pengesanan Botnet P2P Menggunakan Teknik Pengenalpastian Nilai Ambang

  • Wan Ahmad Ramzi Wan Yusuf Kolej Komuniti Masjid Tanah
  • Mohammad Hairy Kharauddin Kolej Komuniti Masjid Tanah
  • Mohd Rizal Dolah Kolej Komuniti Masjid Tanah

Abstract

P2P Botnet or ‘Peer to Peer’ Botnet is known as one of the most dangerous threats to computer network technology. Previously, several detection techniques have been proposed to detect its presence. One of the techniques focused is on feature sets as a detection mechanism. However, previous studies highlighted feature detection for this Botnet family found that there is a lack of research on the threshold value feature as botnet detection. Research so far tends to focus on detection features rather than analysis on the feature itself. In this study, identifying threshold values ​​for P2P Botnet detection is based on seven bot samples and 52 features taken from the observed network traffic. suggests methodologies consisting of feature selection modules, logistics regression modules and threshold value identification. The approach successfully identifies a set of features to detect P2P Botnets. The traffic observation test shows that P2P Botnet detection is based on the pushed_data_pkts_b2a and pure_act_pkts_a2b features where the threshold cutting value for both is at 80% detection rate which contributes to the detection of botnet P2P botnet detection at a higher rate.

Published
2020-12-01
How to Cite
WAN YUSUF, Wan Ahmad Ramzi; KHARAUDDIN, Mohammad Hairy; DOLAH, Mohd Rizal. Pengesanan Botnet P2P Menggunakan Teknik Pengenalpastian Nilai Ambang. Politeknik & Kolej Komuniti Journal of Life Long Learning, [S.l.], v. 4, n. 1, p. 58-72, dec. 2020. ISSN 2600-7738. Available at: <https://myjms.mohe.gov.my/index.php/PKKJLLL/article/view/11370>. Date accessed: 10 aug. 2022.

Most read articles by the same author(s)

Obs.: This plugin requires at least one statistics/report plugin to be enabled. If your statistics plugins provide more than one metric then please also select a main metric on the admin's site settings page and/or on the journal manager's settings pages.