Automatically generating models for botnet detection

摘要: A botnet is a network of compromised hosts that under the control single, malicious entity, often called botmaster. We present system aims to detect bots, independent any prior information about command and channels or propagation vectors, without requiring multiple infections for correlation. Our relies on detection models target characteristic fact every bot receives commands from botmaster which it responds in specific way. These are generated automatically traffic traces recorded actual instances. have implemented proposed approach demonstrate can extract effective variety different families. precise describing activity bots raise very few false positives.