Data Stream Clustering for Botnet Detection

Data stream clustering is an unsupervised approach that is applicable for huge datastreams. Analyzing big datasets and extracting the patterns are valuable in many applications. One of the major application of data stream clustering is in the area of intrusion detection. In this work, the data stream clustering algorithm, DBSTREAM, is used for the purpose of botnet detection. A botnet is a logical collection of computers, smartphones or loT devices compromised by downloads of malicious software by hackers. Existing approaches for botnet detection work on static data. In this work, a traffic model for botnet traffic is generated using the data stream clustering algorithm and detection is done based on the distance of test traffic from the generated model. Testing of the model is done using the CTU-13 and LBNL datasets. Results thus obtained are compared with BOTFINDER.