Abstract:

In order to attain the signature characteristics rapidly and detect unknown botnets precisely, an automated extracting signatures algorithm and a system designing framework are presented according to the distribution of the botnet signature characteristics, they can selfadaptively extract the signature characteristics on data flows of different functions. Experiment shows that the improved algorithm acquires far more effective signatures than before and so it can detect the numerous variants of the botnet efficiently.