Application Entropy Theory to Detect New Peer-to-Peer Botnet with Multi-chart CUSUM

Botnets have been recognized as one of the most important threats to the security of the Internet. They engage in distributed denial of service (DDOS) attacks, email spamming and other malicious activities likewise. As evolving new features such as decentralized architecture, using P2P networks and etc, new peer-to-peer(P2P) botnets could no longer be indicated effectively and accurately by using the traditional detection methods. And we believe that adopting more sophisticated methods from being detected would be the very trend of future botnet development. Thus, in this paper, based on several of the new P2P botnet characteristic properties, we propose a novel detecting method applying the information entropy theory in the detection multi-chart CUSUM. With verification of experiments, it successfully detects the botnet with a relatively high precision.