P2P botnet detection based on association between common network behaviors and host behaviors

Botnet has become the most serious security threats on the current Internet infrastructure. Botnet is a group of compromised computers (Bots) which are remotely controlled by its originator (BotMaster) under a common Commond-and-Control (C&C) infrastructure. Botnets can not only be implemented by existing well known applications, but also can be constructed by unknown or creative applications, which makes the botnet detection a challenging problem. Because the P2P (peer to peer) botnet is a distributed malicious software network, it is more difficult to detect this bot. In this paper, we proposed a new general p2p Botnet detection framework. Our framework is based on the association between common p2p network behaviors and host behaviors.