Behaviour based botnet detection with traffic analysis and flow interavals using PSO and SVM

Since botnet becomes one of the most significant Internet threats, numerous research efforts have been devoted to mitigate botnet threats. We reviewed various botnet detection mechanisms that can be classified according to their approaches, detection object, and source data. The bots provide a different kind of implemented features to a corresponding controlling entity. This entity is commonly a command-and-control server under the control of one or more persons, called the bot masters or botherders, who relay commands through this server. Depending on the infrastructure of the network, the bots are connected with each other to enable this loosly coupled control structure. Alternatively, they can exist completely independently, not knowing of the existence of other bots. In the early period of the age of botnet, many botnet detection approaches have been suggested and host-based detection is the one of them. Host-based detection approaches mainly aim to investigate abnormal activities in a computer by analyzing the internal components of the computer system. Main advantage in using host based detection approaches is that they allows normal users to easily and actively detect abnormal activities in their system. The recent botnets have begun using common protocols such as TCP/HTTP which makes it even harder to distinguish their communication patterns. Most of the TCP/HTTP bot transportations are founded on TCP connections. Here we are using behavior based technique for TCP/HTTP botnet detection because TCP/HTTP bots are variant in nature thus not suitable for signature based detection.