IRC Botnets´ Homology Identifying Method Based on Improved LB_PAA Distance of Communication Characteristic Curves

IRC botnet can be regarded as a collection of compromised computers (called Zombie computers) running software under the command-and-control infrastructure constructed by the IRC server. The connection between the botnet server and the bots are usually very dynamic. In order to describe a botnet at a finer granularity, the paper proposed a method that identify homologous botnets by extracting communication characteristic curves and compute the dynamic time warping distance between the curves, and used improved LB_PAA distance to reduce computational complexity. Experiments were carried out for validation purposes, the error rates were evaluated and shown.