A Revised Ant colony Optimization Scheme for Discovering Attack Paths of Botnet

Transcription

1 A Revsed Ant colony Optmzaton Scheme for Dscoverng Attack Paths of Botnet Png Wang Department of MIS Kun Shan Unversty Tanan, Tawan Hu-Tang Ln Insttute of Computer and Communcaton Engneerng Natonal Cheng Kung Unversty Tanan, Tawan Tzy Shah Wang Insttute of Computer and Communcaton Engneerng Natonal Cheng Kung Unversty Tanan, Tawan Abstract IP traceback technque s an effectve method to fnd ether the attack orgn or command-and-control (C&C) server on the Internet. Because the tradtonal ACO (ant colony optmzaton) constantly converged to a local mnmum soluton easly such that the global optmalty of the fnal soluton mght be mss. Accordngly, the present study proposes a modfed ACS (ant colony system) scheme desgnated as ACS-IPTBK to solve the IP traceback problem, predct both the most probable attack path and the computatonal resources needed n botnets. The ablty of the ants to search all feasble attack paths s enhanced by means of a global heurstcs. A seres of ns2 smulatons are performed to nvestgate the mnmum number of routng packets requred to successfully reconstruct the attack path, the correlaton between the packet quantty and the convergence tme for attack paths of dfferent attack lengths usng random network topologes were constructed usng a random graph generator based on Waxman s scheme. Fnally, the robustness of the proposed scheme toward spoofed IP attacks n nvestgated. Overall, the results confrm that the proposed method provdes an effectve means of reconstructng the path between the attacker and the vctm based on the ncomplete routng nformaton from the related ISPs. Keywords-Botnet; IP traceback; Attack path; Ant colony system; Waxman s scheme I. INTRODUCTION The problem of dentfyng the orgn of an attack over the Internet s referred to as the IP traceback (IPTBK) problem. Typcally, the IPTBK problem nvolves collectng suffcent route nformaton to determne all the possble paths between the attacker and the vctm gven a constrant on both the quantty of routng packets collected and the computatonal tme. Solvng the IPTBK problem s of crucal concern to nformaton urty management n detectng the orgn of a malcous attack and brngng the perpetrator to court. Consequently, many methods for reconstructng the attack path have been proposed recently. Most exstng methods for solvng the IPTBK problem focus on DDoS (dstrbuted denal of servce) attacks [2,6] where In a DDoS attack, a malcous user, referred to as a herder, utlzes a Command and Control (C&C) server to ntate an attack on a sngle target by a multtude of compromsed systems. The resultng flood of ncomng messages overwhelms the target, causng t to shut down and to deny access to legtmate users. The compromsed systems are referred to as zombes, and collectvely form a botnet. Whle the motvaton of most herders n establshng a botnet s that of fnancal gan, or smply attractng recognton amongst hs or her peers, the botnet may also be hred out to thrd partes to conduct a range of nefarous actvtes, ncludng sendng out spam messages, dstrbutng vruses, nstallng spyware, and so on. Although varous IP traceback methods [2,6] have been proposed for the detecton network attacks and classfcaton purposes, they nvarably assume the full cooperaton of all the servers between the vctm and the C&C server n provdng the routng nformaton requred to reconstruct the attack path. However, n practce, some servce provders prefer not to provde ths nformaton. As a result, t s necessary to reconstruct the path gven only a lmted knowledge of the routng nformaton. Furthermore, as dscussed above, n solvng the IPTBK problem, t s desrable to mnmze both the convergence tme and the amount of routng nformaton requred to reconstruct the attack path n order to ensure a prompt and effectve response to perceved or actual attacks. Inspred by [11], the present study proposes a modfed ACS (ant colony system) optmzaton scheme desgnated as ACS-IPTBK for solvng the IPTBK problem subject to the constrant of mnmzng both the number of routng packets requred to reconstruct the path and the convergence tme requred for the reconstructon process. In developng the proposed algorthm, the ablty of the ants to search all the feasble attack paths between the vctm(s) and the attack orgn s enhanced by means of a global heurstcs. The valdty of the proposed algorthm s demonstrated by performng a seres of experments conducted by Network Smulator 2 (ns2). Secton II presents prevous studes n the AS (ant system) feld and descrbes the use of the AS method n solvng the IPTBK problem. Secton III descrbes the modfed ACS scheme proposed n ths study for solvng the IPTBK problem, dscusses the expermental results and examnes the performance of the two global heurstcs and nvestgates the correlaton between the mnmum number of routng packets requred to reconstruct the attack path and the network sze. Fnally, Secton VI provdes some bref concludng remarks and ndcates the ntended drecton of future research.

2 II. THE AS OPTIMIZATION SCHEMES IN SOLVING IPTBK PROBLEM Ths ton overvew of AS (ant system) optmzaton schemes and ntroduces the applcaton of ACO to IP traceback problem as follows. A. Overvew of AS optmzaton schemes AS, the frst Ant Colony Optmzaton (ACO) algorthm, was proposed by Colorn et al [1] n In a later study, the performance of AS was enhanced va three new search strateges, namely Ant-densty, Ant-quantty and Ant-cycle [9]. Furthermore, Stuetzle and Hoos [11], proposed a maxmn ant system (MMAS) n whch a constrant was mposed on the pheromone ntensty update range [ τ max, τ mn ] n order to prevent premature convergence to a local sub-optmal soluton. Only global best or teraton best tour deposted pheromone. All edges are ntalzed to τmax and rentalzed to τmax when nearng stagnaton. Dorgo and Gambardella [8] developed an enhanced AS algorthm desgnated as Ant Colony System (ACS) to search for the optmal path wthn a complex soluton space subject to both tme and cost constrants. In general, ACO schemes provde an effectve means of solvng a range of complex optmzaton problems n the computer scence and operatons feld, ncludng quadratc assgnment problems [12], Job-shop schedulng problems [13], vehcle routng (VR) problems [8-9], network routng problems [7], and so on. B. Applcaton of ACO to IP Traceback Problem Assume that the IPTBK problem s to be solved usng an ant colony comprsng m ants. In the soluton procedure, each ant establshes a complete path between the attacker and the vctm by choosng network nodes to vst n accordance wth a state transton rule. Once all of the ants have completed ther tours, the pheromone ntensty at each of the nodes s updated usng a global updatng rule. The process s repeated teratvely n ths way untl the specfed termnaton crtera are met. To global optmal soluton of AS, a random searchng polcy was gven to reconstruct the possble attack paths for fndng ther way back to nest as follows: When selectng a route between the vctm and the attack source, each ant n the colony performs a complete search of all arcs (, at tme t n accordance wth the followng transton rule, α β [ τ ] [ η ] p =, (1) α β [ τ ] [ η ] j N where p s the probablty that an ant chooses a path from node to node j and η (namely the vsblty) s defned as η = 1/ d, where d represents the dstance (.e., the number of hops) between node and node j. Furthermore, α s a pheromone ntensty weghtng factor and β s a vsblty weghtng factor. The ant colony updates the probablty densty functon of the feasble attack paths and help the ant select the rght path back to the nest. Fnally, the notaton j N ndcates that node j s a member of the set of nodes n the neghborhood of node whch the ant has not yet vsted. Trace by the hgher ntensty of the pheromone over a tral. In reconstructng the possble attack paths, the path search of each ant between adjacent routers (, s gven by τ ( t + 1) = (1 ρ) τ + Δτ, (2) where τ denotes the amount of pheromone on arc (, at tme t. (Note that the ntal pheromone ntensty,.e., τ (), can be set to any arbtrarly chosen value). Moreover, ρ represents the evaporaton (or decay) rate of the pheromone and has a value n the nterval [,1], where a hgher value ndcates a more rapd decay. Fnally, Δ τ represents the addtonal pheromone deposted on arc (, by the ants whch travel along ths arc durng the current tme perod,.e., m Δτ = Δτ, (3) k= 1 where Δ τ k s the amount of pheromone lad by the k- th ant on arc (, between tme (t 1 ) and tme t and m s the total number of ants n the colony. Colorn et al. [9] proposed the followng Ant Quantty (ANT-Q) formula for determnng the value of Δ : Q Lk Δτ = f τ (, path k done by k th ant, (4) where L k s the number of nodes along the path traversed by ant k and Q s a constant. (3) shows that the pheromone ntensty along route (, s nversely proportonal to L k. In other words, shorter routes attract a greater number of ants. Once every ant has moved, the selecton probabltes of each path are computed n accordance wth (1) ~ (4). Note that all of the nodes vsted by each ant up to tme t are memorzed n a Tabu lst to prevent the ant from re-vstng the same node durng the search process. The process descrbed above s repeated teratvely for a preset number of cycles. Fnally, the ants found the approprate path that leads them back to the nest (.e., the attack orgn). III. ACS HEURISTIC MODEL FOR IPBK PROBLEM In the present study, the ACS optmzaton method s used to solve the IPTBK problem because ants can

3 effectvely search all the feasble attack paths between the vctm(s) and the source subject to both tme and cost constrants, even when the ISPs do not fully cooperate n provdng all the routng nformaton requred. In mplementng the optmzaton procedure, two research objectves are as follows: () to dentfy the most probable attack path subject to the constrant of mnmzng both the number of routng packets (cost), and () the convergence tme requred for the reconstructon process n dfferent network topologes. Note that the attack path s assumed to be a non-cyclc drected graph n order to ensure the convergence of the soluton procedure. Let the network topology be represented as a drected graph, G=(V,E), where V represents a set of nodes, V={v 1, v 2,, v n }; V s s a set of source nodes (.e., attack sources); V d s a set of snk nodes (.e., vctms), and E denotes the edges of the graph. In the ACS model, two arbtrary nodes of network topology representng attack source and vctm are chosen to as end nodes of path for dscoverng the attack paths. Solvng the IPTBK problem usng the ACS algorthm explots three fundamental characterstcs of AS schemes, namely collectve ntellgence, cooperatve learnng and dstrbuted optmzaton. Accordngly, n the followng develop a modfed algorthm desgnated as ACS-IPTBKK based on ACS optmzaton scheme, a meta-heurstcs s proposed for ncreasng the dversty of the searched attack paths n the IPTBK problem. As dscussed n the followng, the algorthm s mplemented usng a three-step approach. Step 1: Creaton of network topology The present study focuses on the urty management aspect of network servces. The servce-orented network topology s smulated and establshed for model analyss. To examne the mnmum quantty of packets requred to reconstruct the attack path by the ACS-TPBK model to solve the IPTBK problem, varous expermental network topologes were constructed usng a random graph generator based on Waxman s scheme [3]. In constructng the topologes, the generator randomly placed p nodes at nteger coordnates over a rectangular area of sze n*n. Adjacent nodes, v and v j, were then connected to form edges wth a probablty of d(, P(, = η exp( ), (5) Lγ where d (, s the Eucldean dstance between nodes v and v j, and L s the maxmum possble dstance between any two nodes n the topology. In addton, η and γ are two parameters wth values n the nterval (,1] used to obtan the desred characterstcs n the graph. Specfcally, a hgher value of η ncreases the average degree of the nodes, whle a larger value of γ ncreases the rato of the number of long edges to short edges. Step 2: Tour Re-constructon In solvng the IPTBK problem usng ACS, each ant bulds a tour (.e., a feasble path between the vctm and the attacker) by repeatedly applyng the state transton rule as follows. 1) State transton rule: The path searchng process s accomplshed usng a state transton rule comprsng two polces, namely explotaton and based exploraton. The explotaton polcy (see 6(a)) chooses the arc wth the greatest product of pheromone ntensty and vsblty, whle the based exploraton polcy (see 6(b)) s a random decson rule. Thus, an ant located at node chooses the next node j n accordance wth the followng rule: arg max{[ τ j tabu k j = S α ][ η β ]} f q q o ( a) (6) ( b) α β [ τ ( t)] [ η( t)] j N α β S = p [ ( t)] [ ( t)] = τ η ( c) where q s a user-defned parameter whch specfes the dstrbuton rato of the two polces, and q s a random number, q 1. Here η s calculated as the number of routng packets between router and router j between tme (t- 1) and tme, and s used to smulate the vsblty of the ants on arc (,. Whle constructng ts path, each ant ncreases the amount of pheromone on the traversed tral by applyng a local updatng rule. Once all of the ants have completed ther tour, the ntensty of the pheromone on the path s updated once agan by means of a global updatng rule. As descrbed above, to search the global optmal soluton of ACS, two search polces are gven to reconstruct the possble attack paths, when ants fnd ther way back to nest. () Explotaton: trace by the hgher ntensty of the pheromone over a tral, however, ths strategy mght lead to algorthm converges to a local optmal soluton, () Exploraton: renforce ant s sght ablty for drecton searchng by examnng tral ntensty of pheromone. Ths strategy make ants search more flexble than that of the former. Based on exploraton polcy, path research of adjacent routers for each ant s gven by the followng local updatng rule. 2) Local updatng rule :The purpose of the local pheromone updatng rule s to prevent an excessve number of ants from selectng the same tral, thereby causng the soluton procedure to converge prematurely to a local suboptmal soluton. After travelng a path, each ant updates the pheromone level on each arc of the path n accordance wth τ ( t + 1) = (1 w) τ + wδτ, (7)

4 where w represents the evaporaton or decay rate of the local pheromone, resdng n [,1], and Δ τ s equal to τ n the ntal state, and s specfed by the ANT-quantty (see (3)) or ANT-cycle strategy [9]. 3) Global updatng rule:once all of the ants have completed ther tours n the current teraton, the ntensty of the pheromone assgned to each arc of the optmal path s recalculated, that s, the ntensty of the pheromone path can be revsed after all the ants select ther route from the vctm to an attack source as follows: τ ( t + 1) = (1 ρ) τ + ρδτ (8) C f route (, LG Δτ = s the optmal path where C s a constant and L s the number of nodes on the G optmal path. A hgher value of C results n a more rapd convergence tme. (6)~(8) are appled repeatedly untl all of the members of the ant colony trace the same path back to the nest. 4) Route Improvement Strateges: A meta-heurstcs are proposed to ncrease the number of explored attack paths, thereby prevent the ACS algorthm from convergng prematurely to a local, sub-optmal soluton. The proposed heurstcs satsfy two specfc objectves, namely () to fnd the global optmal soluton rather than a local optmal soluton by reducng the updatng speed of the global pheromone; and () to acheve a balance between the updatng speed of the local pheromone and the updatng speed of the global pheromone. As descrbed n the followng, the four heurstcs are mplemented by modfyng the global updatng rule n the orgnal ACS algorthm. 5) ANT-Subgroup: The ant colony s dvded nto multple subgroups, where each subgroup has a dfferent pheromone updatng rule. The ant subgroups are desgned to prevent the ACS algorthm from convergng too rapdly and get stuck n local optma; thereby precludng the dentfcaton of a more sutable global optmal soluton. Thus, n the ANT-Subgroup model, the pheromone updatng rule s gven as τ ( t + 1) = (1 ρ) τ + ρδτ (9) C f kth Lks path n Δτ = route sth s the optmal sub group path where C s a weghted constant, and L ks s the hop number of attack path k for the s-th subgroup of ants. In accordance wth (8), the ncrease n the pheromone ntensty along the path from router to router j s re-calculated only when an ant wthn the s-th Subgroup walks along the k-th route, whch belongs to the optmal path. Step 3: Aganst Spoofed IP attacks If bot herders want to masquerade by hdng ther attack locaton usng fake IP, then true orgn mght be lost. Thus, attack scenaros wth fake source addresses needed to be verfed whether ACS algorthm can dscover the correct attack paths or not. In the followng, authors descrbe how to locate source addresses of fake IP. Based on the network behavor anomaly detecton, ACS scheme can easly fnd the correct attack path by comparng the quantty change of attack packets (.e., tral ntensty of pheromone). Furthermore, two detaled cases can be dscussed n the followng, () Not on attack path: If fake IP does not locate on the attack path but near attack orgn, ACS can avod tracng to a dscontnuous path n nature and get a feasble soluton by path searchng rules usng (6)-(8). () On attack path: If fake IP s located on the attack path. For nodes of near fake IP, quantty of attack packets receved mght be dramatcally reduced. Thus defender need set a ratonal threshold of collected attack packets to detect the stuaton of an attack has occurred. Once the packet ratng of a node lowers a preset threshold, a spoofed IP attack mght happen. In practce, t s hard to choose a certan value of threshold theoretcally over a network, because upper bound of packet quantty of botnet attacks s random. However, tral ntensty of pheromone slently reveals the nformaton by comparng the quantty varaton of attack packets between the upstream node and downstream node. From [4], t dsclosed that nodes close to the vctm constantly gathered hgher quantty of attack packets than the farther cases that lead to hgher tral ntensty of pheromone. Ths useful detecton rule can help defender dscover some network anomaly behavors. Therefore, when the quantty of collected attack packets n downstream node dmnshed under the threshold, defender can add a penalty functon, μ to the node and cause to decrease n pheromone ntensty for punshment. When spoofed IP attack has happened, adjust the update rule of pheromone ntensty as τ ( t + 1) = (1 ρ ) τ + μ (1) ρδτ f AttPackets AttPackets j < δ μ = ρδτ AttPackets represents the quantty of attack packets for node, δ means a threshold whose value s decded by quantty mean of packets collected on paths. In the further, defender s nterested n the ssue how to determne the lower bound of the quantty of attack packets to dscover the anomaly stuaton occurred.

5 Here authors proposed a packet-based detecton rule usng the cubc-splne nterpolaton formula to predct the quantty mean of attack packets, AttPackets n process of m computaton. By applyng the standard dervaton of statstcal packet number to show the confdence degree of evdence, we can gan the upper and lower bound of confdence [λ, w]. And then w can be used for assstng defender to determne a fake IP. [ λ, ϖ ] = AttPackets ± 2σ (11) m AttPackets The False Alarm Rate (FAR) s defned as the rato of between false counts and total test runs aganst spoofed IP attacks as, FAR= False counts/total test runs (12) The pseudo-code of the ACS-TPBK model for path reconstructon process s llustrated n Fg. 1. IV. TESTING AND VALIDATION A seres of ns2 smulatons was performed to nvestgate the potental threat to a typcal servce network by botnet attacks and to explore the effectveness of the ACS-TPBK model n solvng the IPTBK problem. The smulatons were performed usng a PC wth an Intel Dual core CPU 3.G, DDR2 1G of RAM and the MS Wndows XP operatng system. The proposed method s appled to solve ths problem accordng to the followng four steps: Step 1. Creaton of network topology. Assume that the generator randomly places 1, 2, and 5 nodes (p=1,2,5) at nteger coordnates over a rectangle area of sze 5*5, as shown n Fg. 2. The random network topologes are then created n accordance wth (5) by constructng edges between adjacent nodes wth varous values of η n the ranges.3~1.5 and γ n the ranges.5~.15, respectvely. The man dfferences between our research wth our prevous approaches n our work [5] are summarzed as () Both attack and vctm are arbtrary pont, such A and B n Fg.2 whch not constraned to end ponts n the topology that ncreases the feasble solutons. () The arbtrary two pont of IP trackback problem rases the searchng dffculty of attack path. Table 1 ndcates the mnmum, average and maxmum degree of a node, respectvely as well as maxmum and average length of a path for each combnaton of η and γ. From Table 1, parameter η affects the average degree of these nodes, that s, ncrease of η wll brng about a hgh average degree. Nevertheless too small η case mght lead to the low the average degree; n the worst case, generates some cases of edges that can not create the connected paths. Step 1. Intalze Construct route graph based on topology Set t:= for,j = 1 to k Intalze pheromone τ for nodes on route(, for t = 1 to k Lay h ants on startng node for q = 1 to m Reset Δτ := for every and j Step 2. Reconstructon of attack paths for q = 1 to m f ant(q) not arrved at vctm node Move ant to neghbor node j Update probablty P (t ) usng (6) Add node j nto q th route soluton //Local pheromone update for,j = 1 to k f route(, s n q th route soluton Set τ ( t + 1) = (1 w) τ + wδτ usng (7) else Set τ ( t + 1) = (1 w) τ + wδτ //Global pheromone update Compute most probable route soluton and L G If node s n most possble route soluton Set C τ ( t + 1) = (1 ρ) τ ( t) + ρ usng (8) LG //The tabu lst records the route solutons Step 3. If spoofed IP attack s occurrng Set τ ( t + 1) = (1 ρ) τ u usng (1) + If termnaton crtera (2 rounds) not satsfed Empty all route solutons (tabu lst) for q = 1 to m Swap startng node nto q th route soluton Return to Step2 else output optmal route soluton Fgure 1. ACS algorthm for IP traceback of botnet detecton Step 2: Reconstructon of attack paths The attack paths were constructed usng the followng two-step procedure: Step 2.1: Attack on vctm The test case wth 5 random attacks was smulated usng a Monte Carlo model and lay 16 (32) ants to generate the routng nformaton for each network node. The average packets quantty of vsted node s counted as the bass of

6 A B Applyng the searchng rule as (6), ants travel around all trats back to nest usng the local and global pheromone updatng rules gven n (7)~(8). Consequently, there are several possble attack paths to be dscovered. Then, examne the relatonshp between the scales of network topology and the feasble solutons where both the teraton process and rato of ants on the attack path are calculated for montorng the convergence effects of ACS-TPBK scheme. From Fg. 3, a large topology wth long dstance d (hops) requres a hgh substantal quantty of packet to successfully reconstruct the attack path. Fg. 4 revealed that routes wth long edges n a network topology mght ncrease the probablty of searchng n a wrong-path drecton such that smaller groups of ants were found on the attack path when teratons had performed. Fgure 2. Smulated network topology (p=2) TABLE I. RANDOM TOPOLOGIES BASED ON WAXMAN S SCHEME (P=2, γ =.1) Max degree Mn degree Avg degree Max length Avg length η= η= η= η= η= updatng the pheromone ntensty, assstng ants to search paths and evaluate the soluton qualty. Step 2.2: Traceback to attack paths The routng nformaton generated n Step 2.1 was used as the nput dataset to the ACS model. Four mportant parameters n ACS are: () populaton of colony s set to 16 (or 32). () execute 1 tmes loop and update path searchng rules by 2 teratons (generatons) for each loop, () set α (pheromone ntensty weghtng factor) 1.5 and β(vsblty weghtng factor) 1.2 based on analyss of Table 2, and (v) the decay rate of pheromone s.5 n (1), (v) constant C n (8) s set to Fgure 3. The number of packets requred for path reconstructon wth dfferent d (hops) TABLE II. SOLUTION QUALITY (NUMBER OF PACKETS ON ATTACK PATH) WITH DIFFERENT VALUES OF Α, Β node1 α=.9 α=1.2 α=1.5 α=1.8 α=2.1 β= β= β= β= β= Fgure 4. The coverage percentage of ants on attack paths wth dfferent quantty of packets In performng the smulatons, the ant colony (m=16) was dvded usng three dfferent sub-groupng polces, namely 2- p (.e., 2 subgroups wth each subgroup havng 8 ants), 4-p, 8-p and 16-p. For each of the consdered sub-groupng polces, the pheromone ntensty was re-calculated usng (9) only when the subgroup members traversed the optmal

7 (attack) path. The computatonal results of performance evaluaton of ant-subgroup model are presented n Fg. 5. It shows soluton qualty for 2-p, 4-p, 8-p and 16-p s better than the orgnal ACS model (control). Furthermore, the 2-p subgroup converges faster than those of the other three subgroups, snce the computatonal overhead ncurred by the communcaton among the sub-group causes the overall effcency to reduce. In further, set the ant colony m=32 redo ths experment and gans the smlar results. 2.% 16.% 12.% 8.% 4.% nodes=4 nodes=8 nodes=6 nodes=1 Ant number on attack path (%) Generaton Fgure 5. Percentage of the ants on the best route of Ant-Subgroup control Once performance effcency tested, cost factor of ACS- TPBK also need be nvestgated for objectvely evaluatng. From Table3, convergence tme of the optmal path for four subgroups are derved n 2-25 cycles whose converge s slower than the orgnal ACS model (control) about 2 cycles to converge. A specal case s 16-p where the effcency of scheme wll decrease wth more sub-groups,.e., a decreasng number of ants n each subgroup. TABLE III. 2-p 4-p 8-p 16-p CONVERGENCE TIME OF DIFFERENT SUBGROUPS (P=2, 2 GENERATIONS) control 2-p 4-p 8-p 16-p Step 3. Spoofed IP attack Botmaster constantly hde the attack orgns usng fake IP. Ths experment set an alternatve node as fake IP to fnd the true address of attack source; Here a ratonal threshold (ε) s set to.5, and then conduct a detecton experment usng (1)~(12). After executed 1 runs of smulatons, the teraton number and false rate derved by spoofed IP attacks s shown as Fg. 6. From Fg. 6, Ants eventually would not be attracted by the spoof IP and most ants can walk back to the correct attack paths progressvely by ncreasng the ntensty of colony pheromone after 5, 8, 1 and 11 teratons for dfferent nodes, respectvely. As a result, ACS-TPBK can conquer the spoofed IP attacks..% Fgure 6. False rate on path researchng of spoofed IP attack V. CONCLUSIONS Ths study has presented an ACS-based IP traceback model wth a heurstc scheme for botnet detecton, whch allows defenders to reconstruct the most probable attack path even though not all of the IPs cooperate n provdng routng nformaton. The applcaton of ant technology to the botnet detecton problem provdes a reasoned approach for understandng the behavor of attackers. As a result, the proposed method mproves the precson of the IP traceback soluton. The expermental results confrm the ablty of the proposed scheme to detect the attack source and the probable zombes wthn the attack path despte an ncomplete knowledge of the routng nformaton wthn the botnet. The search effcency usng dfferent algorthms wth dfferent network topologes n the botnet detecton problem wll be tackled n future studes. References [1] M. Dorgo, V. Manezzo, A. Colorn, Postve Feedback as a Search Strategy, Techncal report, No , Department of Electroncs, Mlan Polytechnc Insttute, June [2] A. C. Snoeren, C. Partrdge, L. A. Sanchez, and C. E. Jones, Hashbased IP traceback, n Proceedngs of ACM (SIGCOMM 1), San Dego, Calforna, August 27-31, 21, pp [3] B. M. Waxman, Routng of multpont connectons, IEEE Journal on Selected Area on Communcatons, Vol. 6, No.9, pp , [4] C. Langn, Z. Hongbo, S. Rahm, B. Gupta, M. Zargham, and M.R. Sayeh, A Self-Organzng Map and ts Modelng for Dscoverng Malgnant Network Traffc, IEEE Symposum on Computatonal Intellgence n Cyber Securty, pp , 29. [5] P. Wang, H.T. Ln,T. C. Wang, P.T. Kuo, A new approach for solvng the IP traceback problem for Web servces, Internatonal Journal on Advances n Informaton Scences and Servce Scences, Vol.3, No.2, pp.46-59, 211. [6] S. Bellovn, M. Leech, and T. Taylor, ICMP traceback messages, Internet Draft: draft-etf- trace-1.txt, Oct. 21. [7] G. D Caro, M. Dorgo, AntNet: Dstrbuted stgmergetc control for communcatons networks, Journal of Artfcal Intellgence Research, Vol. 9, pp , 1998 [8] M. Dorgo, L.M. Gambardella, Ant colony system: A cooperatve learnng approach to the travelng salesman problem, IEEE Transactons on Evolutonary Computaton, Vol. 1, No.1,pp , 1997.

8 [9] A. Colorn, M. Dorgo, V. Manezzo, Dstrbuted optmzaton by ant colones, n: Proceedngs of ECAL91 European Conference on Artfcal Lfe, Pars, France, 1991, pp [1] G. H. La, C. M. Chen, B. C. Jeng, W. Chao, Ant-based IP traceback, Expert Systems wth Applcatons, Vol. 34, 28, pp [11] Stuetzle, T., Hoos, H. (1997) Improvements on the ant system: Introducng max-mn ant system, n Proceedngs of ICANNGA'97, Internatonal Conference on Artfcal Neural Networks and Genetc Algorthms, Sprnger, Venna, [12] A. Colorn and V. Manezzo, The ant system appled to the quadratc assgnment problem, IEEE Transactons on Knowledge and Data Engneerng, Vol. 11, No. 5, pp [13] D. Martens, M. De Backer, R. Haesen, J. Vanthenen, M. Snoeck, B. Baesens, Classfcaton wth Ant Colony Optmzaton, IEEE Transactons on Evolutonary Computaton, Vol. 11, No. 5, pp , 27.