On Botnet Detection in Networks, based on Traffic Monitoring

One of the serious and widespread attacks in cyber security is Botnet. Using command and control infrastructure or peer-to-peer communication between bots, botmasters can perform a variety of attacks on internet system-users. To mitigate this, multiple techniques have been developed for botnet detection over the past two decades. In this paper we have discussed various botnet structures and the different techniques of botnet detection proposed in literature. We evaluated these techniques based on their distinctive features and presented their detailed comparative analysis. We also proposed a method for botnet detection using network traffic monitoring. Our approach is based on combining signature and anomaly detection systems that complement each other. Our proposed hybrid detection system may decrease false positive rate in anomaly detection by finding the well-known bots using signature detection and thereby may increase overall detection efficiency.