Correlation-based HTTP Botnet detection using network communication histogram analysis

The latest generation of Botnets use HTTP protocol and port 80 as their communication medium to impersonate themselves as normal web users and avoid current security solutions. In addition, the Botmasters who control the infected devices employ several techniques, such as encryption, code obfuscation, anti-honeypot capabilities and random communication patterns to keep their Bots undetectable as long as possible. However, Bots are designed to be...