Lightweight C&C based botnet detection using Aho-Corasick NFA

نویسندگان
چکیده

منابع مشابه

An Efficient Linear Pseudo-minimization Algorithm for Aho-Corasick Automata

A classical construction of Aho and Corasick solves the pattern matching problem for a finite set of words X in linear time, where the size of the input X is the sum of the lengths of its elements. It produces an automaton that recognizes A∗X, where A is a finite alphabet, but which is generally not minimal. As an alternative to classical minimization algorithms, which yields a O(n logn) soluti...

متن کامل

An Aho-Corasick Based Assessment of Algorithms Generating Failure Deterministic Finite Automata

The Aho-Corasick algorithm derives a failure deterministic finite automaton for finding matches of a finite set of keywords in a text. It has the minimum number of transitions needed for this task. The DFA-Homomorphic Algorithm (DHA) algorithm is more general, deriving from an arbitrary complete deterministic finite automaton a language-equivalent failure deterministic finite automaton. DHA tak...

متن کامل

Implementing the Aho-Corasick Automata for Phonetic Search

In phonetic search, the goal is to find in a text all words with the same pronunciation as the search phrase. The user writes the word down using a different alphabet and transcription rules. Mrázová et al. proposed a new method for phonetic search based on searching for all possible transcriptions with Aho-Corasick automata [8]. Their algorithm offers better precision than the previous existin...

متن کامل

Commentz-walter: Any Better than Aho- Corasick for Peptide Identification?

An algorithm for locating all occurrences of a finite number of keywords in an arbitrary string, also known as multiple strings matching, is commonly required in information retrieval (such as sequence analysis, evolutionary biological studies, gene/protein identification and network intrusion detection) and text editing applications. Although Aho-Corasick was one of the commonly used exact mul...

متن کامل

DGA-Based Botnet Detection Using DNS Traffic

In recent years, an increasing number of botnets use Domain Generation Algorithms (DGAs) to bypass botnet detection systems. DGAs, also referred as “domain fluxing”, has been used since 2004 for botnet controllers, and now become an emerging trend for malware. It can dynamically and frequently generate a large number of random domain names which are used to prevent security systems from detecti...

متن کامل

ذخیره در منابع من


  با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید

ژورنال

عنوان ژورنال: International Journal of Network Security & Its Applications

سال: 2010

ISSN: 0975-2307

DOI: 10.5121/ijnsa.2010.2413