Botnet Detection for Peer to Peer Networks

Botnets are the latest types of internet-scale malware in recent years that has been the greatest threats to the web servers. Bot is an infected computer by a malware that are controlled remotely by one or more human factors without the user’s knowledge. This controller agent called “bot master” and sometimes the infected system is called “victim”. Peer to peer botnet is one type of botnets that use peer to peer protocols and detection of this type of botnet is more difficult than other types. Our suggested approach is a new method to detect such botnets. This approach uses network flow analysis and clustering method in data mining to detect peer to peer botnets. This approach is flow-based and compares the similarity between flows and K-Means clustering algorithm and eventually determines that the new traffic is an attack or not. This approach has good performance in detection of botnets in flash crowd traffic and this characteristic is distinction of the suggested algorithm and similar algorithms. Finally, the suggested approach has been tested with different traffic.