
Botnets have started using Information obfuscation techniques include encryption to evade detection. In order to detect encrypted botnet traffic, in this paper we see detection of encrypted botnet traffic from normal network traffic as traffic classification problem. After analyses features of encrypted botnet traffic, we propose a novel meta-level classification algorithm based on content features and flow features of traffic. The content features consist of information entropy and byte frequency distribution, and the flow features consist of port number, payload length and protocol type of application layer. Then we use Naive Bayes classification algorithms to detect botnet traffic. The related experiment shows that our method has good detection effect.
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 4 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Average | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Average | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Average |
