FAST FLUX BOTNET DETECTION BASED ON ADAPTIVE DYNAMIC EVOLVING SPIKING NEURAL NETWORK Ahmad Al Nawasrah Thesis Submitted in Partial Fulfilment of the Requirements of the Degree of Doctor of Philosophy School of Computing, Science and Engineering University of Salford, Salford, UK 2018 Supervisor: Prof. Farid Meziane TABLE OF CONTENTS TABLE OF CONTENTS ..........................................................................................................I LIST OF TABLES ................................................................................................................. III LIST OF FIGURES ................................................................................................................. V DECLARATION ..................................................................................................................VIII ABBREVIATIONS ................................................................................................................. IX LIST OF PUBLICATIONS ................................................................................................. XII ABSTRACT ..........................................................................................................................XIII KEYWORDS ........................................................................................................................XIII CHAPTER ONE ....................................................................................................................... 1 INTRODUCTION ..................................................................................................................... 1 1.1 Introduction ....................................................................................................................... 1 1.2 Research Problem .............................................................................................................. 4 1.3 Research Motivation: ........................................................................................................ 6 1.4 Research Aim and Objectives ........................................................................................... 6 1.5 Research Methodology ...................................................................................................... 7 1.6 Contributions of the Research ......................................................................................... 10 1.7 The Scope of the Research .............................................................................................. 10 1.8 Thesis Structure ............................................................................................................... 10 CHAPTER 2 ............................................................................................................................ 13 BACKGROUND LITERATURE REVIEW AND RELATED WORK ............................ 13 2.1 Background ..................................................................................................................... 13 2.1.1 Single Fast Flux ........................................................................................................ 15 2.1.2 Double Fast Flux ...................................................................................................... 17 2.1.3 Hydra Fast Flux ........................................................................................................ 20 2.1.4 Domain Flux ............................................................................................................. 20 2.2 Literature Review ............................................................................................................ 21 2.2.1 Host-based Detection Methods ................................................................................. 24 2.2.2 Router-based Detection Methods ............................................................................. 44 2.2.3 DNS-based Detection Methods ................................................................................ 46 2.2.4 Hydra Flux Service Network .................................................................................... 53 2.2.6 Dynamic evolving Spiking Neural Network (DeSNN) ............................................ 53 2.3 Related Work ................................................................................................................... 55 2.4 Conclusion ....................................................................................................................... 60 CHAPTER THREE ................................................................................................................ 62 ADAPTIVE DYNAMIC EVOLVING SPIKING NEURAL NETWORK – ADESNN.... 62 3.1 Introduction ..................................................................................................................... 62 3.2 Adaptive Dynamic Evolving Spiking Neural Network ................................................... 62 3.3 Dataset ............................................................................................................................. 69 3.4 Experiments, Result, and Comparison ............................................................................ 70 3.5 Chapter Summary: ........................................................................................................... 78 CHAPTER FOUR ................................................................................................................... 80 SUPERVISED FAST FLUX KILLER APPROACH FFKA .............................................. 80 4.1 Introduction ..................................................................................................................... 80 i 4.2 Fast Flux Killer Approach ............................................................................................... 80 4.3 Supervised Learning Phase ............................................................................................. 82 4.3.1 The Preprocessing Stage ........................................................................................... 82 4.3.2 Feature Extraction ..................................................................................................... 83 4.3.3 Adaptive dynamic evolving spiking neural network ................................................ 83 4.4 Dataset ............................................................................................................................. 84 4.5 Feature Selection ............................................................................................................. 84 4.6 Feature Set ....................................................................................................................... 85 4.7 Experiments and Discussion ........................................................................................... 86 4.7.1 Introduction .............................................................................................................. 86 4.7.2 Supervised Fast Flux Killer Approach Experiment .................................................. 87 4.7.3 Feature Set Discussion .............................................................................................. 93 4.8 Conclusion ....................................................................................................................... 97 CHAPTER FIVE .................................................................................................................... 99 HYBRID FAST FLUX KILLER APPROACH ................................................................... 99 5.1 Introduction ..................................................................................................................... 99 5.2 The Hybrid Fast Flux Killer Approach (Supervised and unsupervised) ....................... 100 5.2.1 Introduction ............................................................................................................ 100 5.2.2 The FFKA Supervised Phase .................................................................................. 100 5.2.3 The FFKA Unsupervised Phase ............................................................................. 100 5.3 Dataset ........................................................................................................................... 103 5.4 Feature Set ..................................................................................................................... 103 5.5 Experiment and Discussion ........................................................................................... 103 5.5.1 The Results of the Hybrid FFKA ........................................................................... 104 5.5.2 Comparison of Supervised and Hybrid approach ................................................... 106 5.5.3 Parameter Adjustment and Customization ............................................................. 109 5.6 chapter summary ........................................................................................................... 110 CHAPTER SIX ..................................................................................................................... 112 DISCUSSION, CONCLUSION AND RECOMMENDATION FOR FUTURE WORK ................................................................................................................................... 112 6.1 Discussion ..................................................................................................................... 112