Research of botnet anomaly detection alogrithm based on private protocol

Since the most domestic popular botnets based on private protocols use encrypted communication, the performance of traditional anomaly detection methods based on DPI technology for botnet is not ideal. This paper, with utilization of the feature that there exists periodic communication behavior in botnet, regards source IP, destination IP and destination port as the unique identifier to extract the time sequence which is analyzed in frequency domain. Because abnormal data has obvious periodicity, the corresponding distribution of frequency is relatively more centralized while normal data decentralized. Based on the spectral characteristics, this paper uses coefficient of variation of spectrum and spectral entropy to realize anomaly detection of botnet. Experimental results show that the detection algorithm based on coefficient of variation of spectrum achieves better results.