DCA for Bot Detection
Yousof Al-Hammadi, Uwe Aickelin, Julie Greensmith

TL;DR
This paper applies the biologically inspired Dendritic Cell Algorithm (DCA) to detect individual bots on compromised hosts, demonstrating its effectiveness in identifying malicious activities like keylogging and packet flooding.
Contribution
It introduces the use of the DCA for bot detection on host machines, showcasing its ability to identify malicious behavior without false positives.
Findings
DCA successfully detects a single bot on a compromised host.
The algorithm correlates behavioral attributes like keylogging and flooding.
DCA effectively distinguishes malicious activity from normal processes.
Abstract
Ensuring the security of computers is a non-trivial task, with many techniques used by malicious users to compromise these systems. In recent years a new threat has emerged in the form of networks of hijacked zombie machines used to perform complex distributed attacks such as denial of service and to obtain sensitive data such as password information. These zombie machines are said to be infected with a 'bot' - a malicious piece of software which is installed on a host machine and is controlled by a remote attacker, termed the 'botmaster of a botnet'. In this work, we use the biologically inspired Dendritic Cell Algorithm (DCA) to detect the existence of a single bot on a compromised host machine. The DCA is an immune-inspired algorithm based on an abstract model of the behaviour of the dendritic cells of the human body. The basis of anomaly detection performed by the DCA is facilitated…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
