Botnet evolution: Network traffic indicators

• Published in: Proceedings - 2014 International Symposium on Biometrics and Security Technologies, ISBAST 2014
• Main Author: Rostami M.R.; Eslahi M.; Shanmugam B.; Ismail Z.
• Format: Conference paper
• Language: English
• Published: Institute of Electrical and Electronics Engineers Inc. 2015
• Online Access: https://www.scopus.com/inward/record.uri?eid=2-s2.0-84922789067&doi=10.1109%2fISBAST.2014.7013134&partnerID=40&md5=1de86640990bb8fcb8ee9e746da8aff9

In recent years, the HTTP has become dominant protocol among other protocols for the Internet services as it provides a set of rules to manage the data exchange between servers and browsers. On the other hand, this standard protocol has been widely used in the latest generation of botnets to establish their command and control channel and hide their malicious activities among normal Web traffic. Therefore, analyzing HTTP traffic has become a common method in current HTTP-based botnet detection studies. Since the HTTP botnets are a new phenomenon,they have not been fully explored yet. Therefore, in this paper we present an overview of the features and parameters that have been used in existing studies to detect HTTP botnets along with their shortcomings. We also propose a number of HTTP protocol characteristics that can be used for further botnet analysis and detection. © 2014 IEEE.