Bots Behaviors vs. Human Behaviors on Large-Scale Communication Networks (Extended Abstract)

  • Wei Lu
  • Ali A. Ghorbani
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5230)


In this paper we propose a hierarchical framework for detecting and characterizing any types of botnets on a large-scale WiFi ISP network. In particular, we first analyze and classify the network traffic into different applications by using payload signatures and the cross-associations for IP addresses and ports. Then based on specific application community (e.g. IRC, HTTP, or Peer-to-Peer), we present a novel temporal-frequent characteristic of flows that leads the differentiation of malicious behaviors created by bots from normal network traffic generated by human beings. We evaluate our approach with over 160 million flows collected over five consecutive days on a large-scale network and preliminary results show the proposed approach successfully detects the IRC botnet flows from over 160 million flows with a high detection rate and an acceptable low false alarm rate.


False Alarm False Alarm Rate High Detection Rate Normal Network Application Community 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Wei Lu
    • 1
    • 2
  • Ali A. Ghorbani
    • 1
  1. 1.Faculty of Computer ScienceUniversity of New BrunswickFrederictonCanada
  2. 2.Department of Electrical and Computer EngineeringUniversity of VictoriaCanada

Personalised recommendations