Research of botnet anomaly detection alogrithm based on private protocol
Luying Chen, Xinliang Wang, Xin Zhao, Weimin Li · 2010 3rd IEEE International Conference on Broadband Network and Multimedia Technology (IC-BNMT) · 2010
Since the most domestic popular botnets based on private protocols use encrypted communication, the performance of traditional anomaly detection methods based on DPI technology for botnet is not ideal. This paper, with utilization of the feature that there exists periodic communication behavior in botnet, regards source IP, destination IP and destination port as the unique identifier to extract the time sequence which is analyzed in frequency domain. Because abnormal data has obvious periodicity, the corresponding distribution of frequency is relatively more centralized while normal data decentralized. Based on the spectral characteristics, this paper uses coefficient of variation of spectrum and spectral entropy to realize anomaly detection of botnet. Experimental results show that the detection algorithm based on coefficient of variation of spectrum achieves better results.