Disclosure

摘要: Botnets continue to be a significant problem on the Internet. Accordingly, great deal of research has focused methods for detecting and mitigating effects botnets. Two primary factors preventing development effective large-scale, wide-area botnet detection systems are seemingly contradictory. On one hand, technical administrative restrictions result in general unavailability raw network data that would facilitate large scale. other were this available, real-time processing at scale formidable challenge. In contrast data, NetFlow is widely available. However, imposes several challenges performing accurate detection.In paper, we present Disclosure, system incorporates combination novel techniques overcome imposed by use data. particular, identify groups features allow Disclosure reliably distinguish C&C channels from benign traffic using records (i.e., flow sizes, client access patterns, temporal behavior). To reduce Disclosure's false positive rate, incorporate number external reputation scores into our system's procedure. Finally, provide an extensive evaluation over two large, real-world networks. Our demonstrates able perform datasets order billions flows per day.