Method of detecting IRC Botnet based on the multi-features of traffic flow - Jian-en YAN; Chun-yang YUAN; Hai-yan XU; Zhao-xin ZHANG (Tongxin xuebao)
To resolve the problem of detecting IRC Botnet,a method based on traffic flow characteristics was proposed.The characteristics of Botnet channel traf?cwere analyzed in different periods such as data-clustering,data-similarity,the average length of packet,peak of synchronized traf?c,and peak of collaborative synchronized traf?c,and these characteristics were used to detect the botnet.In analyzing,improved max-min distance means and k-means cluster analysis algorithm were also presented to promote the efficiency of data clustering.At last,the availability of the method was verified by experiment.