A Novel Approach to Detect IRC-Based Botnets

Bot nicknames within one IRC-based botnet must have uniform structure, because they are generated by the same bot fixedly. In this paper, the similarity of nicknames in the same channel is defined by the term dasiachannel distancepsila. And a novel algorithm based on channel distance is proposed to detect IRC-based botnets. The most significant contribution of this algorithm is that it can detect new IRC-based botnets without any delay. As a universal approach to detect IRC-based botnets, this algorithm does not need any pre-analysis to existing bots. Botnet detection program based on this algorithm has run stable for two weeks on a high-performance internet information capture platform, and successfully detected 161 botnet channels.