A Multi-Layered Approach to Botnet Detection

– The goal of this research was to design a multi-layered architecture for the detection of a wide range of existing and new botnets. By not relying on a single technique but rather building in the ability to support multiple techniques, the goal is to be able to detect a wider array of bots and botnets than is possible with a single technique. The open architecture and API will allow any techniques designed by other researchers to be integrated. The goal is to use signature type techniques to detect well-known bots and botnets and data mining techniques to detect new classes and variants; i.e. anomaly or misuse detection.