Batch clustering of online attack narratives for botnet detection

1. A method comprising:

identifying, from online clustering data comprising a plurality of event clusters, an internet protocol (IP) pair, wherein the IP pair comprises two source IP addresses;

determining, during an offline process of clustering the plurality of event clusters, a distance metric corresponding to a distance between a feature of each of the two source IP addresses;

determining, by a processing device during the offline process, that the IP pair is part of a botnet when the distance metric is less than a predefined threshold;

in response to the determining, appending data associated with the botnet to the online clustering data to generate enhanced clustering data; and

analyzing, using an online clustering algorithm, a new set of incidents based on the enhanced clustering data to detect events occurring over a time frame or events occurring over multiple sites, wherein the new set of incidents are analyzed to classify the new set of incidents based on at least one selected from a group comprising a number of customers involved, a type of attack, and a histogram/distribution of industries, and wherein the new set of incidents are classified as being a targeted attack or a community attack as being an industry-based attack or a spray-and-pray attack.

2. The method of claim 1 , wherein in response to the determining, the method further comprising blocking one or more IP addresses associated with the botnet.

3. The method of claim 1 , further comprising:

extracting the feature from the online clustering data; and

defining a distance function corresponding to the distance metric, the distance function to calculate a distance between the feature of the two source IP addresses, respectively.

4. The method of claim 3 , wherein the feature comprises at least one of: an IP property, a correlation property, a narrative property, or a history property.

5. The method of claim 1 , further comprising determining that the botnet is associated with a multi-site attack.

6. The method of claim 1 , further comprising determining that the botnet is associated with an attack occurring over a duration that exceeds a predefined threshold.

7. The method of claim 1 , further comprising determining that the botnet is associated with an attack occurring over a regular period.

8. A system, comprising:

a memory to store data associated with a botnet; and

a processing device, operatively coupled to the memory, the processing device to:

identify, from online clustering data comprising a plurality of event clusters, an internet protocol (IP) pair, wherein the IP pair comprises two source IP addresses;

determine, during an offline process of clustering the plurality of event clusters, a distance metric corresponding to a distance between a feature of each of the two source IP addresses;

determine, during the offline process, that the IP pair is part of the botnet when the distance metric is less than a predefined threshold;

in response to the determination, append the data associated with the botnet to the online clustering data to generate enhanced clustering data; and

analyze, using an online clustering algorithm, a new set of incidents based on the enhanced clustering data to detect events occurring over a time frame or events occurring over multiple sites, wherein the new set of incidents are analyzed to classify the new set of incidents based on at least one selected from a group comprising a number of customers involved, a type of attack, and a histogram/distribution of industires, and wherein the new set of incidents are classified as being a targeted attack or a community attack as being an industry-based attack or a spray-and-pray attack.

9. The system of claim 8 , wherein in response to the determination, the processing device is further to block one or more IP addresses associated with the botnet.

10. The system of claim 8 , the processing device further to:

extracting the feature from the online clustering data; and

defining a distance function corresponding to the distance metric, the distance function to calculate a distance between the feature of the two source IP addresses, respectively.

11. The system of claim 8 , wherein the feature comprises at least one of: an IP property, a correlation property, a narrative property, or a history property.

12. The system of claim 8 , the processing device further to determine that the botnet is associated with a multi-site attack.

13. The system of claim 8 , the processing device further to determine that the botnet is associated with an attack occurring over a duration that exceeds a predefined threshold.

14. The system of claim 8 , the processing device further to determine that the botnet is associated with an attack occurring over a regular period.

15. A non-transitory computer-readable storage medium, comprising instructions, which when executed by a processing device cause the processing device to:

identify, from online clustering data comprising a plurality of event clusters, an internet protocol (IP) pair, wherein the IP pair coprises two source IP addresses;

determining, during an offline process of clustering the plurality of event clusters, a distance metric corresponding to a distance between a feature of each of the two source IP addresses;

determine, by the processing device during an offline process, that the IP pair is part of a botnet when the distance metric is less than a predefined threshold;

in response to the determination, append data associated with the botnet to the online clustering data to generate enhanced clustering data; and

analyze, using an online clustering algorithm, a new set of incidents based on the enhanced clustering data to detect events occurring over a time frame or events occurring over multiple sites, wherein the new set of incidents are analyzed to classify the new set of incidents based on at least one selected from a group comprising a number of customers involved, a type of attack, and a histogram/distribution of industries, and wherein the new set of incidents are classified as being a targeted attack or a community attack as being an industry-based attack or a spray-and-pray attack.

16. The non-transitory computer-readable storage medium of claim 15 , wherein in response to the determination, the processing device is further to block one or more IP addresses associated with the botnet.

17. The non-transitory computer-readable storage medium of claim 15 , the processing device further to:

extracting the feature from the online clustering data; and

defining a distance function corresponding to the distance metric, the distance function to calculate a distance between the feature of the two source IP addresses, respectively.