A Protocol-Independent Botnet Detection Method Using Flow Similarity

Figure 8

TCP flow distribution in the training dataset. The abscissa represents the botnet, and the ordinate represents the number of flows.