Detecting a botnet in a network

by   Gianmarco Bet, et al.

We formalize the problem of detecting the presence of a botnet in a network as an hypothesis testing problem where we observe a single instance of a graph. The null hypothesis, corresponding to the absence of a botnet, is modeled as a random geometric graph where every vertex is assigned a location on a d-dimensional torus and two vertices are connected when their distance is smaller than a certain threshold. The alternative hypothesis is similar, except that there is a small number of vertices, called the botnet, that ignore this geometric structure and simply connect randomly to every other vertex with a prescribed probability. We present two tests that are able to detect the presence of such a botnet. The first test is based on the idea that botnet vertices tend to form large isolated stars that are not present under the null hypothesis. The second test uses the average graph distance, which becomes significantly shorter under the alternative hypothesis. We show that both these tests are asymptotically optimal. However, numerical simulations show that the isolated star test performs significantly better than the average distance test on networks of moderate size. Finally, we construct a robust scheme based on the isolated star test that is also able to identify the vertices in the botnet.


page 1

page 2

page 3

page 4


Localized geometry detection in scale-free random graphs

We consider the problem of detecting whether a power-law inhomogeneous r...

Threshold for Detecting High Dimensional Geometry in Anisotropic Random Geometric Graphs

In the anisotropic random geometric graph model, vertices correspond to ...

Community detection in inhomogeneous random graphs

We study the problem of detecting whether an inhomogeneous random graph ...

Lost in the Shuffle: Testing Power in the Presence of Errorful Network Vertex Labels

Many two-sample network hypothesis testing methodologies operate under t...

Hypothesis Testing for Equality of Latent Positions in Random Graphs

We consider the hypothesis testing problem that two vertices i and j of ...

Instance-Based Classification through Hypothesis Testing

Classification is a fundamental problem in machine learning and data min...

Shape Reconstruction and Recognition with Isolated Non-directional Cues

The paper investigates a hypothesis that our visual system groups visual...

Please sign up or login with your details

Forgot password? Click here to reset