P2P Botnet Detection through Malicious Fast Flux Network Identification

A recent development in botnet technology is the adoption of P2P architecture as way to improve botnet resilience to disruption compared to the centralized architecture used by early botnets. Furthermore, in order to increase stealth and evade detection, many P2P botnets, such as storm, are employing fast flux service networks (FFSNs). We propose in this paper, a new P2P botnet detection approach by identifying malicious FFSNs. We define and compute a number of metrics from captured network flows which are analyzed using machine learning classification. For the proposed approach, we show experimentally that the presence of botnets may be detected with a high accuracy and identify its potential limitations.