Modeling Botnets' Similarity Based on Communication Feature Extraction and IP Assembly

Abstract

IRC botnet can be regarded as a collection of compromised computers(called Zombie computers)running software under the command-and-control infrastructure constructed by the IRC servers.The connection between the botnet server and the bots are usually very dynamic.In order to describe a botnet at a finer granularity,the paper proposes a method that measures the similarity of botnets by extracting and comparing the metrics such as communication volumes,frequency,and the overlap rate of bots.A novel model for botnet similarity measuring is proposed by combining those metrics mentioned.Experiments are carried out for validation purposes,the confidence of the accuracy is evaluated and shown,and the migration situation of botnet are also discussed.