The improvement and research of the compromised machines detection algorithm

To realize the detection of the compromised machines in the botnet, TRW (Threshold Random Walk) algorithm was deliberated. And then the similarity of the inbound packets payload and the time distance of the inbound-outbound packets pair between the compromised machines would be evaluated and induced to an overall similarity, which is also called similarity factor, and to substitute in to the modified TRW algorithm. The result of the experiments had proved that modified algorithm could distinctly minimized the number of the time windows, and also proved the feasibility, validity and accuracy of the algorithm used in the detection of compromised machines in the local area network detection.