P2P Botnet Detection Based on Nodes Correlation by the Mahalanobis Distance

Adaptability of IRC Botnet Detection Method to P2P Botnet Detection

This report mainly discusses the adaptability of the IRC-based Bot detection method to be used in the P2P-based Bot detection. The first section introduces the IRC-based bot and the newly appeared P2P-based bot to see their difference. The second section shows the related work and the traditional method of BOTNET detection. The third section discusses the methodology used by the IRC based Botne...

Correlation-based Botnet Detection in Enterprise Networks

P2P Botnet Detection Using Min-Vertex Cover

P2P botnet is one of the most critical threats to the current Internet security. In this paper, we propose a session-based analysis and minimum vertex cover mining detecting model for core nodes of P2P botnets. This model is focused on solving the core nodes of botnet and has a good performance when the characteristics of botnet are changed to avoid detecting. The simulation experiments reveal ...

Group Behavior Metrics for P2P Botnet Detection

We propose a set of metrics for efficient botnet detection. The proposed metrics captures the unique group behavior that is inherent in bot communications. Our premise for proposing group behavior metrics for botnet detection is that, group behavior observed in botnets are unique and this unique group behavior property is inherent in the botnet architecture. The proposed group behavior metrics ...

Normalized Clustering Algorithm Based on Mahalanobis Distance

FCM (fuzzy c-means algorithm) based on Euclidean distance function converges to a local minimum of the objective function, which can only be used to detect spherical structural clusters. The added fuzzy covariance matrices in their distance measure were not directly derived from the objective function. In this paper, an improved Normalized Clustering Algorithm Based on Mahalanobis distance by t...