Method to detect botnet based on network coordination

Abstract

A novel method to detect botnet based on network coordination is proposed. This paper constructs a coordinative detection model of botnet, by utilizing hybrid network structure and analyzing information of a large number of detection nodes. First, detect abnormal attack behavior of nodes. Then define the set of nodes with similar behavior and build a coordinative task. At last, detect botnet nodes by the coordinative task. The experiment in LAN indicates that the method can identify similar behavior in network, and then detect botnet nodes. The controllability of this model is good.