Peer-to-Peer BotNet Traffic Analysis and Detection

Abstract

One of the most serious threats against the Internet is attacks from botnets. The botnet amplifies the intensity of attacks through the cooperation of compromised hosts. Recently, some botnets have evolved into a decentralized structure like peer-to-peer (P2P) network. Without fixed C&C servers, P2P botnets are difficult to detect. In this paper, we proposed a multi-step P2P botnet detection system based on botnets' probing characteristics. The first step uses entropy of information theory to detect the compromised hosts with great performance, and the second step (duplication ratio) concentrates on decreasing false positives. The experiment results show better false positive rate than a previous system.