Botnet Detection Based on Correlation of Malicious Behaviors

Botnet has become the most serious security threats on the current Internet infrastructure. Botnet is a group of compromised computers (Bots) which are remotely controlled by its originator (BotMaster) under a common Command and Control (C&C) infrastructure. Botnets can not only be implemented by using existing well known bot tools, but can also be constructed from scratch and developed in own way, which makes the botnet detection a challenging problem. Because the P2P (peer to peer) botnet is a distributed malicious software network, it is more difficult to detect this bot. In this paper, we proposed a new general Botnet detection correlation algorithm, which is based on the correlation of host behaviors and classification method for network behaviors. The experimental results show the proposed approach not only can successfully detect known botnet with a high detection rate but it can also detect some unknown malware.