Detection of web based command & control channels
Martin Warmer · 2011
Recent malware allows criminals to remotely control computers using Command & Control (C&C) channels. These channels are used to perform criminal activities using infected computers. These activities pose a threat to both the user of the infected computer and other computer users on the network. This threat can be mitigated by detecting C&C channels on the network. In this thesis we attempt to improve the detection capabilities for web based C&C channels. We provide a survey of current C&C channel detection techniques and study the behaviour of web based C&C channels. Based on these results, we propose three new techniques for detecting HTTP and HTTPS based C&C channels.We evaluate these techniques and provide an overview of their detection capabilities.