Detection of botnet collusion by degree distribution of domains

摘要: Malicious botnets threaten the Internet by DDoS-attacks, spam, information theft and other criminal activities. They are using increasingly sophisticated techniques to hide Command Control traffic. Many existing detection can be defeated encryption, tunneling in popular protocols, delays, flow perturbation. We introduce a new DNS-based approach, that detects botnet collusion anomalies degree distribution of visited domains, without any assumption about message content statistical properties The proposed technique is difficult evade, major changes bot Infrastructure or reduced utility. evaluate evasion possibilities, derive theoretical model detector performance test with combination captured traffic simulated botnet-traffic.