An analysis of network traffic characteristics for Botnet detection

Abstract

The fast evolution of Botnet malware made it extremely difficult to detect. Despite it can be just considered as a tool, nowadays it has become one of the most dangerous threats for system administrators. Botnets are used as the starting point for di erent kind of attacks, such as SPAM, Denegation of Service, key logging and tra c sni ng, among others. In this paper we analyze some of the most relevant network tra c characteristics used for Botnet recognition. We have reviewed the most important works in the eld of Botnet detection and have carried out an analysis in order to establish which are more appropriate to describe the Botnet behavior. Our final goal is to provide to network administrators the bases for building tools that can help them in their daily ght against this security threat.