Web-Based Botnet Detection Based on Flow Information

Abstract

Botnet is the major source of Cyber attacks. Botmaster controls and commands the infected hosts to launch DDoS (Distributed Denial-of-Service) attack or send SPAM through some public protocols such as IRC (Internet Relay Chat), P2P (Peer-to-Peer) or Web (HTTP). Web-based Botnet is much difficult to detect its existence because of the command and control messages of Web-based Botnet issued through HTTP protocol and hidden behind normal web network traffic. In this research, we focus on analysis and detection of Web-based Botnet according to the features of Web-based Bots. The experiment shows the proposed approach gets good results in many different topology designs. It also shows high detection rate in real network environment.