User Traffic Profile for Traffic Reduction and Effective Bot C&C Detection

Bots are malicious software components used for generating spams, launching denial of service attacks, phishing, identity theft and information exfiltration and such other illegal activities. Bot detection is an area of active research in recent times. Here we propose a bot detection mechanism for a single host. A user traffic profile is used to filter out normal traffic generated by the host. The remaining suspicious traffic is subject to detailed analysis. The nature of detailed analysis is derived from a characterization of bot traffic. The detection system is tested using two real world bots. Performance evaluation results show that the proposed system achieves a high detection rate (100%) and a low false positive rate (0–8%). The traffic filtering yielded an average reduction in traffic by 70%.