以決策樹偵測殭屍網路之研究
Botnet is the most dangerous and widespread threat among the diverse forms of malware internet-attacks nowaday. A botnet is a group of damaged computers connected via Internet which are remotely accessed and controlled by hackers to make various network attacks. Malicious activities include DDoS attack, spam, click fraud, identity theft and information phishing. The most basic characteristic of botnets is the use of command and control channels to communicate with botnet and through which bonet can be updated and command. Botnet has become a common and effective tool used by Botmaster in many cyber-attacks. Recently malicious botnets develop to HTTP botnets instead of typical IRC botnets. HTTP botnets is the latest generations of Botnet ,and it use the standard HTTP protocol to contact with their bots. By using the normal HTTP traffic, the bots is consider as normal users of the networks, and the current network security systems cannot detect out them. To solve this problem, a method based on network behavior analysis system was evolved to improve modify and adding new features to the current methods of detecting HTTP-based Botnets and their bots.
