Detection and classification of different botnet C&C channels

Jump to navigation Jump to search

(Publication) Link to the old Wiki page : [1] / Google search: [2]

Detection and classification of different botnet C&C channels
Detection and Classification of Different Botnet C&C Channels.png
Botnet Ircbot, Agobot, Rustock, Storm, Bobax, Waledac, UDP Storm
Botnet/malware group
Exploit kits
Distribution vector
Operation/Working group
CCProtocol IRC, HTTP, P2P
Date 2009 /
Editor/Conference Lehigh University. Bethlehem
Link (Archive copy)
Author Gregory Fedynyshyn, Mooi Choo Chuah, Gang Tan


Unlike other types of malware, botnets are characterized by their command and control (C&C) channels, through which a central authority, the botmaster, may use the infected computer to carry out malicious activities. Given the damage botnets are capable of causing, detection and mitigation of botnet threats are imperative. In this paper, we present a post-based method for detecting and differentiating different types of botnet infections based on their C&C styles, e.g., IRCbased, HTTP-based, or peer-to-peer (P2P) based. Our ability to detect and classify botnet C&C channels shows that there is an inherent similarity in C&C structures for different types of bots and that the network characteristics of botnet C&C traffic is inherently different from legitimate network traffic. The best performance of our detection system has an overall accuracy of 0.929 and a false positive rate of 0.078.


   editor = {Lehigh University. Bethlehem},
   author = {Gregory Fedynyshyn, Mooi Choo Chuah, Gang Tan},
   title = {Detection and classification of different botnet C&C channels},
   date = {24},
   month = Jan,
   year = {2009},
   howpublished = {\url{}},