TY - GEN
T1 - Detecting HTTP-based botnet based on characteristic of the C&C session using by SVM
AU - Yamauchi, Kazumasa
AU - Hori, Yoshiaki
AU - Sakurai, Kouichi
PY - 2013/1/1
Y1 - 2013/1/1
N2 - With the spread of computer, the increase of malware is a serious problem. In some malware, damage caused by botnet is a serious problem. Botnets perform the attack by remote control. The purpose of the present work is to suppress the botnet activity by detecting the C&C traffic through well-suited observations. There already exists many detection techniques, most of which focus on IRC-based botnet, and very little focus on HTTP-based botnet, even less, which include comparisons between both detection techniques. In this work, we focus on the HTTP-based botnet, and in order to classify normal HTTP session and C&C session, we make use of Support Vector Machine.
AB - With the spread of computer, the increase of malware is a serious problem. In some malware, damage caused by botnet is a serious problem. Botnets perform the attack by remote control. The purpose of the present work is to suppress the botnet activity by detecting the C&C traffic through well-suited observations. There already exists many detection techniques, most of which focus on IRC-based botnet, and very little focus on HTTP-based botnet, even less, which include comparisons between both detection techniques. In this work, we focus on the HTTP-based botnet, and in order to classify normal HTTP session and C&C session, we make use of Support Vector Machine.
UR - http://www.scopus.com/inward/record.url?scp=84889057187&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84889057187&partnerID=8YFLogxK
U2 - 10.1109/ASIAJCIS.2013.17
DO - 10.1109/ASIAJCIS.2013.17
M3 - Conference contribution
AN - SCOPUS:84889057187
SN - 9780769550756
T3 - Proceedings - 2013 8th Asia Joint Conference on Information Security, AsiaJCIS 2013
SP - 63
EP - 68
BT - Proceedings - 2013 8th Asia Joint Conference on Information Security, AsiaJCIS 2013
PB - IEEE Computer Society
T2 - 2013 8th Asia Joint Conference on Information Security, AsiaJCIS 2013
Y2 - 25 July 2013 through 26 July 2013
ER -