relation: https://openaccess.city.ac.uk/id/eprint/15580/
title: Survey of Approaches and Features for the Identification of HTTP-Based Botnet Traffic
creator: Acarali, D.
creator: Rajarajan, M.
creator: Komninos, N.
creator: Herwono, I.
subject: QA75 Electronic computers. Computer science
description: Botnet use is on the rise, with a growing number of botmasters now switching to the HTTP-based C&C infrastructure. This offers them more stealth by allowing them to blend in with benign web traffic. Several works have been carried out aimed at characterising or detecting HTTP-based bots, many of which use network communication features as identifiers of botnet behaviour. In this paper, we present a survey of these approaches and the network features they use in order to highlight how botnet traffic is currently differentiated from normal traffic. We classify papers by traffic types, and provide a breakdown of features by protocol. In doing so, we hope to highlight the relationships between features at the application, transport and network layers.
publisher: Elsevier BV
date: 2016-10-14
type: Article
type: PeerReviewed
format: text
language: en
rights: attached
identifier: https://openaccess.city.ac.uk/id/eprint/15580/1/http-bots-feature-survey-final.pdf
format: text
language: en
identifier: https://openaccess.city.ac.uk/id/eprint/15580/8/CC%20BY-NC-ND%204.0.pdf
identifier:   Acarali, D., Rajarajan, M. <https://openaccess.city.ac.uk/view/creators_id/m=2Erajarajan.html>, Komninos, N. <https://openaccess.city.ac.uk/view/creators_id/nikos=2Ekomninos=2E1.html>  & Herwono, I.view all authorsEPJS_limit_names_shown_load( 'creators_name_15580_et_al', 'creators_name_15580_rest' ); (2016). Survey of Approaches and Features for the Identification of HTTP-Based Botnet Traffic. Journal of Network and Computer Applications, 76,    pp. 1-15. doi: 10.1016/j.jnca.2016.10.007 <https://doi.org/10.1016/j.jnca.2016.10.007>  
relation: 10.1016/j.jnca.2016.10.007
identifier: 10.1016/j.jnca.2016.10.007