Efficient Detection of Real-World Botnetsâ€™ Command and Control Channels Traffic
1Abdulmuneem Bashaiwth, 1Basil AsSadhan, 2Jalal Al-Muhtadi, and 1,3Saleh Alshebeili
Progress in Computing Applications, Vol. 3, No. 2, 2014.
DOI: 
Link: 
Abstract:
Botnets are a major security threat to todayâ€™s Internet. Therefore, the detection of botnets has become a central task for network administrators. In this paper, we study the detection of botnets by monitoring and analyzing the Command
and Control (C2) channels communication traffic. We note that this detection approach is effective as it detects a botnet before it engages in any harmful activities. We analyze real network traffic captured at King Saud University network by exploiting the periodic behavior in C2
traffic. We use periodograms to study the periodic behavior, and apply Walkerâ€™s large sample test to detect whether the
traffic has a significant periodic component or not, and, if it does, then it is bot traffic. We apply this test on two different
days of KSU traffic. We show that the traffic in those days exhibit periodic behavior and report the source of that traffic as bot.