P2P Botnet Detection Based on Irregular Phased Similarity

Botnets provide a botmaster infrastructure of management and use of cyber attack capabilities and have become one of the most significant threats to the Internet. The emergence of P2P botnets, which are more stealthy, robust and hazardous, has posed great challenges to botnet detection researches. The paper proposes a novel common P2P botnet detection approach that is able to identify unknown P2P botnets, even in the case that the target network had only a single bot. The traffic generated by a P2P bot has phased similar patterns, which occur at irregular intervals. This feature is called Irregular Phased Similarity (IPS) in the paper. The proposed approach detects P2P bots by identifying IPS characteristic. The experimental evaluation shows the efficiency of the approach on detecting the Storm and Waledac botnets.