Botnet Detection Architecture Based on Heterogeneous Multi-sensor Information Fusion

As technology has been developed rapidly, botnet threats to the global cyber community are also increasing. And the botnet detection has recently become a major research topic in the field of network security. Most of the current detection approaches work only on the evidence from single information source, which can not hold all the traces of botnet and hardly achieve high accuracy. In this paper, a novel botnet detection architecture based on heterogeneous multi-sensor information fusion is proposed. The architecture is designed to carry out information integration in the three fusion levels of data, feature, and decision. As the core component, a feature extraction module is also elaborately designed. And an extended algorithm of the Dempster-Shafer (D-S) theory is proved and adopted in decision fusion. Furthermore, a representative case is provided to illustrate that the detection architecture can effectively fuse the complicated information from various sensors, thus to achieve better detection effect.