An anomaly-based botnet detection approach for identifying stealthy botnets

摘要: Botnets (networks of compromised computers) are often used for malicious activities such as spam, click fraud, identity theft, phishing, and distributed denial service (DDoS) attacks. Most previous researches have introduced fully or partially signature-based botnet detection approaches. In this paper, we propose a anomaly-based approach that requires no priori knowledge bot signatures, C&C protocols, server addresses. We start from inherent characteristics botnets. Bots connect to the channel execute received commands. belonging same receive commands causes them having similar netflows performing Our method clusters bots with attacks in different time windows perform correlation identify infected hosts. developed prototype system evaluated it real-world traces including normal traffic several traces. The results show our has high accuracy low false positive.