Detecting Web-Based Botnets Using Bot Communication Traffic Features

<div>Two host groups related to Web server <svg height="11.8174pt" id="M4" style="vertical-align:-3.1815pt" version="1.1" viewbox="-0.0498162 -8.6359 11.1398 11.8174" width="11.1398pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M449 634C442 637 425 643 405 650C376 660 341 666 307 666C181 666 98 590 98 485C98 400 170 343 215 310L246 288C307 243 343 204 343 147C343 67 291 18 219 18C104 18 61 124 51 202L23 199C28 124 27 71 27 47C47 22 122 -16 204 -16C324 -16 428 60 428 174C428 256 379 309 307 360L276 382C223 419 179 455 179 516C179 576 221 632 293 632C379 632 410 564 418 487L448 490C446 536 446 592 449 634Z" id="g113-84"></path></g><g transform="matrix(.0091,0,0,-0.0091,6.071,3.132)"><path d="M389 0V32C297 38 291 46 291 118V635C234 613 175 595 109 583V556L161 554C203 552 207 547 207 497V118C207 46 201 38 110 32V0H389Z" id="g50-50"></path></g></svg> at two consecutive time intervals <svg height="12.1436pt" id="M5" style="vertical-align:-3.18148pt" version="1.1" viewbox="-0.0498162 -8.96212 12.249 12.1436" width="12.249pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M620 675H597C578 656 570 650 541 650H144C112 650 104 653 94 675H72C59 618 42 552 23 493L53 491C71 534 88 564 105 585C124 608 144 615 238 615H290L197 121C182 40 174 34 88 28L82 0H361L367 28C275 34 266 38 281 121L374 615H441C522 615 543 608 553 583C562 560 566 531 565 493L597 494C603 551 612 629 620 675Z" id="g113-85"></path></g><g transform="matrix(.0091,0,0,-0.0091,7.176,3.132)"><path d="M389 0V32C297 38 291 46 291 118V635C234 613 175 595 109 583V556L161 554C203 552 207 547 207 497V118C207 46 201 38 110 32V0H389Z" id="g50-50"></path></g></svg> and <span class="nowrap"><svg height="12.1436pt" id="M6" style="vertical-align:-3.18148pt" version="1.1" viewbox="-0.0498162 -8.96212 12.249 12.1436" width="12.249pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M620 675H597C578 656 570 650 541 650H144C112 650 104 653 94 675H72C59 618 42 552 23 493L53 491C71 534 88 564 105 585C124 608 144 615 238 615H290L197 121C182 40 174 34 88 28L82 0H361L367 28C275 34 266 38 281 121L374 615H441C522 615 543 608 553 583C562 560 566 531 565 493L597 494C603 551 612 629 620 675Z" id="g113-85"></path></g><g transform="matrix(.0091,0,0,-0.0091,7.176,3.132)"><path d="M414 144C384 79 371 75 317 75H135L276 221C367 316 408 376 408 465C408 570 327 635 237 635C179 635 131 609 100 575L42 494L67 471C94 510 138 565 205 565C277 565 321 517 321 435C321 348 258 270 195 195C146 137 88 81 33 26V0H411C423 44 433 88 446 135L414 144Z" id="g50-51"></path></g></svg>.</span></div>

Security and Communication Networks

Detecting Web-Based Botnets Using Bot Communication Traffic Features

Figure 3