We propose a set of metrics for efficient botnet detection. The proposed metrics captures the unique group behavior that is inherent in bot communications. Our premise for proposing group behavior metrics for botnet detection is that, group behavior observed in botnets are unique and this unique group behavior property is inherent in the botnet architecture. The proposed group behavior metrics ...

In the field of internet security botnet is becoming the significant threat as more number of users are connected to internet. Botnet which is a collection of infected computers so called (bots) are becoming the major threat to internet community. The difference between a malware and botnet is that bot is remotely controlled by a C&C server which are under the control of a botmaster. Here in th...

Zhen Li1 and Qi Liao2 1Department of Economics and Management, Albion College, Albion, Michigan, USA 2Department of Computer Science, Central Michigan University, Mount Pleasant, Michigan, USA ABSTRACT Economics play an increasingly important role in fighting cyber crimes. While the arms race against botnet problems has achieved limited success, we propose an approach attacking botnets through ...

Botnet are identified as one of most emerging threats due to Cybercriminals work diligently to make most of the part of the users’ network of computers as their target. In conjunction with that, many researchers has conduct a lot of study regarding on the botnets and ways to detect botnet in network traffic. Most of them only used the feature inside the system without mentioning the feature inf...

In recent years, botnet has become one of the most serious security threats to Internet. With the rapid development of mobile network and the popularity of smartphones, botnet began to spread to mobile platform. In order to counter mobile botnet, it is meaningful to study its constructive mechanism and reproduce it. In the past studies, researchers have designed several kinds of mobile botnet m...

Current techniques for detecting botnets examine traffic content for IRC commands, monitor DNS for strange usage, or set up honeynets to capture live bots. Our botnet detection approach is to examine flow characteristics such as bandwidth, packet timing, and burst duration for evidence of botnet command and control activity. We have constructed an architecture that first eliminates traffic that...

The presence of compromised hosts in any network degrades the performance in many ways. The compromised nodes form the botnet and the detection of them is most primary solution to improve the network performance. The problem of botnet detection has been approached in many ways using fl ow factors but does not produce a remarking solution. To improve the botnet detection effi ciency, a novel sta...

Over the last few years, researchers and network operators have examined networks of DDoS agents, more recently called botnets due to their connection to Internet Relay Chat (IRC). In the continued quest to take down these networks of bots, two important questions arise: how many bots are there, and how to find every last bot? When one reads about a ten thousand, hundred thousand, one million n...

Abstract—One of the serious threats to cyberspace is the Bot networks or Botnets. Bots are malicious software that acts as a network and allows hackers to remotely manage and control infected computer victims. Given the fact that DNS is one of the most common protocols in the network and is essential for the proper functioning of the network, it is very useful for monitoring, detecting and redu...