Clustering botnet communication traffic based on n-gram feature selection
Computer Communications
Computer Networks: The International Journal of Computer and Telecommunications Networking
Survey and taxonomy of botnet research through life-cycle
ACM Computing Surveys (CSUR)
| Hi-index | 0.00 |
Bot nicknames within one IRC-based botnet must have uniform structure, because they are generated by the same bot fixedly. In this paper, the similarity of nicknames in the same channel is defined by the term ‘channel distance’. And a novel algorithm based on channel distance is proposed to detect IRC-based botnets. The most significant contribution of this algorithm is that it can detect new IRC-based botnets without any delay. As a universal approach to detect IRC-based botnets, this algorithm does not need any pre-analysis to existing bots. Botnet detection program based on this algorithm has run stable for two weeks on a High-performance Internet Information Capture Platform, and successfully detected 161 botnet channels.