On Detection of Storm Botnets

A botnet, which is a group of compromised and remotelycontrolled computers (also called bots), poses a serious threat to the Internet. The commonly-used command and control (C&C) channel for a botnet is used by a central server, such as IRC or HTTP. Recently, Storm botnet, a P2Pbased botnet with a decentralized C&C channel has appeared in the wild. In this paper, we propose a distributed approach to detection of Storm botnets at the network level. Our approach is composed of two stages. First, we identify P2P and SMTP packets from each host’s traffic. Second, we use a machine learning technique to differentiate Storm from benign P2P traffic based on several distinguishing traffic attributes. Both of the two stages only require packet header information without analyzing payloads. Our evaluation has shown the detection strategy to be effective with low false alarm rates.