Apriori-PrefixSpan Hybrid Approach for Automated Detection of Botnet Coordinated Attacks

This paper aims to detect features of coordinated attacks by applying data mining techniques, Apriori and Prefix Span, to the CCC DATA set 2008-2010 which consists of the captured packets data and the downloading logs. Data mining algorithms allow us to automate detecting characteristics from large amount of data, which the conventional heuristics could not apply. Apriori a chives high recall but with false positive, while Prefix Span has high precision but low recall. Hence, we propose hybriding these algorithms. Our analysis shows the change in behavior of malware over the past 3 years.