Online Botnet Detection by Continuous Similarity Monitoring

Botnet detection has attracted lots of attention. But few works have considered online detection. In this paper, we propose a novel approach that can monitor the botnet activities in real time. We define the concept of ldquofeature streamrdquo to describe raw network traffics. If some feature streams show high similarities, the corresponding host will be regarded as suspicious bots which will be added into the candidate bots set to confirm the final results. The experimental evaluations show that our approach can detect botnet activities successfully with high efficiency and low false positive rate.