A Protocol-Independent Botnet Detection Method Using Flow Similarity

<div>The fluctuation of the flow window size with different <span class="nowrap"><svg height="8.98583pt" id="M240" style="vertical-align:-0.2324905pt" version="1.1" viewbox="-0.0498162 -8.75334 43.5389 8.98583" width="43.5389pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M956 650H736V622C814 613 818 602 804 542C789 471 733 275 691 141H689C628 314 570 476 514 641H485C434 478 377 312 323 142H321C277 284 238 419 199 554C184 605 186 613 259 622V650H16V622C77 615 92 606 117 524C172 346 228 170 281 -11H312C363 151 419 312 475 488H477C528 343 597 150 652 -11H683C765 269 826 458 848 522C878 605 887 613 956 622V650Z"></path></g><g transform="matrix(.013,0,0,-0.013,12.127,0)"><path d="M135 536C164 536 186 560 186 587C186 617 164 639 136 639C109 639 85 617 85 587C85 560 109 536 135 536ZM252 0V26C188 32 181 38 181 106V451C138 433 90 420 39 412V388C99 379 102 374 102 312V106C102 38 95 32 32 26V0H252Z"></path></g><g transform="matrix(.013,0,0,-0.013,15.611,0)"><path d="M524 0V26C466 32 460 36 460 104V297C460 393 411 449 331 449C302 449 276 437 248 419C223 402 201 387 181 372V451C137 432 90 420 42 411V388C96 378 102 374 102 310V104C102 38 97 33 29 26V0H246V26C187 32 181 36 181 104V339C211 365 250 390 290 390C357 390 381 345 381 276V109C381 40 374 32 315 26V0H524Z"></path></g><g transform="matrix(.013,0,0,-0.013,22.722,0)"><path d="M409 504C401 567 396 607 392 642C354 654 312 665 266 665C137 665 60 583 60 487C60 374 161 325 225 290C300 250 355 215 355 141C355 68 311 21 235 21C131 21 86 122 71 183L41 176C48 128 61 42 68 21C78 16 93 8 118 0C142 -7 175 -15 216 -15C349 -15 438 69 438 174C438 287 344 333 265 374C186 414 138 449 138 522C138 576 172 631 249 631C336 631 363 562 380 499L409 504Z"></path></g><g transform="matrix(.013,0,0,-0.013,28.806,0)"><path d="M135 536C164 536 186 560 186 587C186 617 164 639 136 639C109 639 85 617 85 587C85 560 109 536 135 536ZM252 0V26C188 32 181 38 181 106V451C138 433 90 420 39 412V388C99 379 102 374 102 312V106C102 38 95 32 32 26V0H252Z"></path></g><g transform="matrix(.013,0,0,-0.013,32.29,0)"><path d="M387 138L374 114C336 54 316 33 240 33H141C223 167 303 295 385 423L379 437H149C112 437 100 443 94 458H73C65 415 50 352 39 314L64 305L78 332C106 388 119 403 191 403C214 403 246 403 280 403C198 270 117 142 31 15L38 0H367C382 40 399 86 413 125L387 138Z"></path></g><g transform="matrix(.013,0,0,-0.013,37.75,0)"><path d="M380 106C343 72 306 56 265 56C195 56 116 112 115 248C235 252 361 262 377 265C396 269 400 277 400 297C400 374 333 449 250 449H249C198 449 144 421 103 376S37 269 37 201C37 88 109 -12 232 -12C263 -12 332 6 395 84L380 106ZM225 412C281 412 315 364 314 312C314 297 308 292 290 292C232 290 176 289 120 289C135 370 180 412 225 412Z"></path></g></svg>.</span> (a) and (b) are the fluctuations of the flow window size in the training and testing datasets, respectively.</div>

Security and Communication Networks

fig10

Figure 10

Figure 10: A Protocol-Independent Botnet Detection Method Using Flow Similarity 