A Protocol-Independent Botnet Detection Method Using Flow Similarity

<div>The hosts with communication relationships are separated based on the IP adjacency graph. The gray dots <svg height="11.5564pt" id="M79" style="vertical-align:-2.26807pt" version="1.1" viewbox="-0.0498162 -9.28833 38.6064 11.5564" width="38.6064pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M293 -169V-141C218 -131 209 -90 209 -44C209 19 222 85 222 152C222 207 198 255 139 269V273C199 286 222 334 222 388C222 454 209 523 209 588C209 632 218 671 293 681V709C234 709 148 695 148 577C147 513 155 438 155 372C155 337 152 291 64 285V256C152 250 155 204 155 169C156 105 148 31 148 -41C148 -157 234 -169 293 -169Z"></path></g><g transform="matrix(.013,0,0,-0.013,4.511,0)"><path d="M219 86C216 168 211 250 206 337C201 410 189 448 163 448C131 448 79 396 43 344L60 322C91 359 110 375 118 375S132 358 136 298C141 238 152 81 155 -12H182C242 62 331 177 390 258C435 321 451 360 451 391C450 424 432 448 408 448C390 448 372 435 366 419C362 410 362 401 366 394C373 383 376 367 376 350C376 283 262 138 221 86H219Z"></path></g><g transform="matrix(.013,0,0,-0.013,10.374,0)"><path d="M384 0V27C293 34 287 42 287 114V635C232 613 172 594 109 583V559L157 557C201 555 205 550 205 499V114C205 42 199 34 109 27V0H384Z"></path></g><g transform="matrix(.013,0,0,-0.013,16.614,0)"><path d="M95 130C70 130 46 113 46 88C46 72 54 64 59 64C93 55 121 33 121 -3C121 -41 93 -68 44 -88L55 -117C117 -98 186 -56 186 22C186 91 131 130 95 130Z"></path></g><g transform="matrix(.013,0,0,-0.013,21.757,0)"><path d="M219 86C216 168 211 250 206 337C201 410 189 448 163 448C131 448 79 396 43 344L60 322C91 359 110 375 118 375S132 358 136 298C141 238 152 81 155 -12H182C242 62 331 177 390 258C435 321 451 360 451 391C450 424 432 448 408 448C390 448 372 435 366 419C362 410 362 401 366 394C373 383 376 367 376 350C376 283 262 138 221 86H219Z"></path></g><g transform="matrix(.013,0,0,-0.013,27.62,0)"><path d="M447 623H65C61 580 56 530 47 475H76C100 541 106 550 172 550H388C308 376 196 170 91 -1L98 -12L172 -2C268 204 360 408 455 611L447 623Z"></path></g><g transform="matrix(.013,0,0,-0.013,33.863,0)"><path d="M283 255V284C195 290 192 337 192 375C192 436 200 508 200 580C200 696 116 709 54 709V681C127 671 139 634 139 588C138 524 125 452 125 387C125 333 149 286 209 272V268C148 253 125 206 125 151C126 87 139 16 139 -47C139 -92 127 -131 54 -141V-169C115 -169 200 -152 200 -41C200 32 192 104 192 164C192 202 195 249 283 255Z"></path></g></svg> are the edges of the subgraphs. By traversing the graph from the boundary nodes, the subgraph can be obtained.</div>

Security and Communication Networks

A Protocol-Independent Botnet Detection Method Using Flow Similarity

Figure 2