A Distributed and Cooperative Approach to Botnet Detection Using Gossip Protocol

TL;DR

This paper proposes a distributed, cooperative botnet detection method using a gossip protocol, enabling rapid sharing of suspicion information across network nodes to identify compromised devices efficiently.

Contribution

It introduces a novel gossip-based approach where each node independently computes suspicion levels and shares them, enhancing detection speed and accuracy in distributed networks.

Findings

Effective detection of compromised nodes through gossip protocol

Rapid dissemination of suspicion values across network nodes

Improved detection speed compared to traditional methods

Abstract

Bots, in recent times, have posed a major threat to enterprise networks. With the distributed nature of the way in which botnets operate, the problems faced by enterprises have become acute. A bot is a program that operates as an agent for a user and runs automated tasks over the internet, at a much higher rate than would be possible for a human alone. A collection of bots in a network, used for malicious purposes, is referred to as a botnet. In this paper we suggested a distributed, co-operative approach towards detecting botnets is a given network which is inspired by the gossip protocol. Each node in a given network runs a standalone agent that computes a suspicion value for that node after regular intervals. Each node in the network exchanges its suspicion values with every other node in the network at regular intervals. The use of gossip protocol ensures that if a node in the network is compromised, all other nodes in the network are informed about it as soon as possible. Each node also ensures that at any instance, by means of the gossip protocol, it maintains the latest suspicion values of all the other nodes in the network.