An Improved Dendritic Cells Algorithm for Detecting P2P Bots

Presently P2P-controlled bots has become an increasing threat to our network security due to the fact that P2P bots do not have a centralized point to shutdown or trace back, thus making the detection of P2P bots is very difficult. To enhance the detection rate, a new model to detect P2P bots on an individual host is proposed by improving the dendritic cells algorithm (IDCA). In the proposed approach, the raw data for P2P bot detection is obtained via APITrace tool. The processes ID are mapped into the antigens, and the behavioral data created by the processes are mapped into the signals, which are the time series input data of IDCA, are used to implement data fusion and correlation. The test experimental results show that the proposed method is effective to detect P2Pcontrolled bots on the host with low false positives.