Fuzzy inference system based on entropy of traffic for bot detection on an endpoint host

Botnet detection is challenging in that bat behaviour is stealthy, varying and bots use several evasion techniques to avoid detection. In this paper, we present a bot detection method for an endpoint host which differentiates the regularity in bot command and control traffic and randomness of user-induced traffic. The regularity/randomness is measured using entropy of traffic features. A characterization of user-induced and bot traffic is done. A fuzzy rule based system is derived from the characterization. The system is tested using a 3-fold cross-validation scheme. Publicly available datasets were also used to estimate an upper bound on the false positives generated by the system. The ability of the system in handling newer variety of bots is tested and the performance of the system is compared with two other methods which also rely on traffic analysis for bot detection.