Abstract
We propose a method for botnet detection from darknet data by non-negative matrix factorization (NMF), which can decompose the vector valued time series data into several components. In addition, we propose a new method to estimate the number of components in the data, by the minimum description length (MDL) principle. Our method for botnet detection consists of change point detection and analysis based on variance of the decomposed data.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Akiyama, M., Kawamoto, T., Shimamura, M., Yokoyama, T., Kadobayashi, Y., Yamaguchi, S.: A Proposal of Metrics for Botnet Detection Based on Its Cooperative Behavior. In: SAINT (2007)
Hamasaki, H., Kawakita, M., Takeuchi, J., Yoshioka, K., Inoue, D., Etoh, M., Nakao, K.: Proposal of Botnet Detection Based on Structure Learning and Its Application to Darknet Data. In: SCIS (2011)
Hotta, S., Miyahara, S.: An Initialization Method for Non-negative Matrix Factorization and Its Applications. Technical report, IEICE (2003)
Inoue, D., Yoshioka, K., Eto, M., Yamagata, M., Nishino, E., Takeuchi, J., Ohkouchi, K., Nakao, K.: An Incident Analysis System NICTER and Its Analysis Engines Based on Data Mining Techniques. In: Köppen, M., Kasabov, N., Coghill, G. (eds.) ICONIP 2008, Part I. LNCS, vol. 5506, pp. 579–586. Springer, Heidelberg (2009)
Kitagawa, J., Kawakita, M., Takeuchi, J., Yoshioka, K., Inoue, D., Etoh, M., Nakao, K.: Extraction of Botnet Communication Based on Non-negative Matrix Factorization. In: SCIS (2010)
Lee, D.D., Seung, H.S.: Algorithms for Non-negative Matrix Factorization. Neural Inf. Process. Syst. 13, 556–562 (2001)
Nikolaus, R.: Learning the Parts of Objects Using Non-negative Matrix Factorization.Term Paper (2007)
Rissanen, J.: Modeling by Shortest Data Description. Automatica 14, 465–471 (1978)
Rissanen, J.: Fisher Information and Stochastic Complexity. IEEE Transactions on Information Theory 42, 40–47 (1996)
Takeuchi, J., Yamanishi, K.: Unifying Framework for Detection Outliers and Change Points from Time Series. IEEE Transactions on Knowledge and Data Engineering 18, 676–681 (2006)
Cyber Clean Center, https://www.ccc.go.jp
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2012 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Yamauchi, S., Kawakita, M., Takeuchi, J. (2012). Botnet Detection Based on Non-negative Matrix Factorization and the MDL Principle. In: Huang, T., Zeng, Z., Li, C., Leung, C.S. (eds) Neural Information Processing. ICONIP 2012. Lecture Notes in Computer Science, vol 7667. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-34500-5_48
Download citation
DOI: https://doi.org/10.1007/978-3-642-34500-5_48
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-34499-2
Online ISBN: 978-3-642-34500-5
eBook Packages: Computer ScienceComputer Science (R0)