Unsupervised detection of botnet activities using frequent pattern tree mining

Abstract A botnet is a network of remotely-controlled infected computers that can send spam, spread viruses, or stage denial-of-service attacks, without the consent computer owners. Since beginning 21st century, activities have steadily increased, becoming one major concerns for Internet security. In fact, are more and difficult to be detected, because they make use Peer-to-Peer protocols (eMule, Torrent, Frostwire, Vuze, Skype many others). To improve detectability activities, this paper introduces idea association analysis in field data mining, proposes system detect botnets based on FP-growth (Frequent Pattern Tree) frequent item mining algorithm. The detection composed three parts: packet collection processing, rule statistical rules. Its characteristic feature rule-based classification different behaviors fast unsupervised fashion. effectiveness approach validated scenario with 11 host PCs, 42063 Non-Peer-to-Peer 17 PCs (Storm, Waledac Zeus). recognition accuracy proposed architecture shown above 94%. method results reported literature.