On the Robustness of Random Walk Algorithms for the Detection of Unstructured P2P Botnets

P2P botnets represent a major threat and are responsible for a wide range of criminal activities. Fortunately, statistical algorithms that operate on NetFlow data have become a reliable means for their detection and can identify infected machines in large networks with high precision. However, many of these algorithms presume visibility on large parts of the communication within the botnet. In addition, so far only structured P2P botnets have been addressed, while especially more recent botnets shifted to unstructured P2P approaches. In this paper, we propose a detection algorithm based on the statistical concept of random walks and test it on real-world graph data of unstructured P2P botnets. Our evaluation results indicate that our algorithm yields high-precision results of about 90% at significantly reduced visibility on bots and their communication. Transferred to an Internet-wide scope, this is achieved when NetFlow data includes at least 5% of the bots and 10% of their communication links.