Botnet evolution: Network traffic indicators

M.R. Rostami, M. Eslahi, B. Shanmugam, Zakiah Ismail

Research output: Chapter in Book/Report/Conference proceedingConference Paper published in Proceedingspeer-review

Abstract

In recent years, the HTTP has become dominant protocol among other protocols for the Internet services as it provides a set of rules to manage the data exchange between servers and browsers. On the other hand, this standard protocol has been widely used in the latest generation of botnets to establish their command and control channel and hide their malicious activities among normal Web traffic. Therefore, analyzing HTTP traffic has become a common method in current HTTP-based botnet detection studies. Since the HTTP botnets are a new phenomenon,they have not been fully explored yet. Therefore, in this paper we present an overview of the features and parameters that have been used in existing studies to detect HTTP botnets along with their shortcomings. We also propose a number of HTTP protocol characteristics that can be used for further botnet analysis and detection. © 2014 IEEE.
Original languageEnglish
Title of host publicationProceedings - 2014 International Symposium on Biometrics and Security Technologies, ISBAST 2014
PublisherIEEE, Institute of Electrical and Electronics Engineers
Pages274-279
Number of pages6
ISBN (Print)978-147996444-4
DOIs
Publication statusPublished - 16 Jan 2015
Externally publishedYes
Event4th International Symposium on Biometrics and Security Technologies - Kuala Lumpur, Malaysia
Duration: 26 Aug 201427 Aug 2014

Conference

Conference4th International Symposium on Biometrics and Security Technologies
Abbreviated titleISBAST 2014
Period26/08/1427/08/14

Fingerprint

Dive into the research topics of 'Botnet evolution: Network traffic indicators'. Together they form a unique fingerprint.

Cite this