Security and Communication Networks

Research Article

A Protocol-Independent Botnet Detection Method Using Flow Similarity

Figure 9

TCP flow distribution in the testing dataset. The abscissa represents the botnet, and the ordinate represents the number of flows.