Detecting Web-Based Botnets Using Bot Communication Traffic Features

Table 6

Comparisons of features used by four approaches.

Calculations	Venkatesh and Nadarajan	Zhao et al.	Cai and Zou	WBD
Counting specific packets	ORT, RIO, PT, SYN, FIN, PSH	PX, PPS, NR	—	—
Arithmetic based on packet size	—	APL, FPS, PV	SHH, CC, SCL	PSS
Arithmetic based on numbers of hosts	—	FPH	BIC	AC, THS
Arithmetic based on interpacket timing	—	TBP	PR	—
Host fingerprinting	—	—	DWS	—