Home > Research > Publications & Outputs > Botyacc


Text available via DOI:

View graph of relations

Botyacc: unified P2P botnet detection using behavioural analysis and graph analysis

Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSNConference contribution/Paperpeer-review

Publication date2014
Host publicationComputer Security - ESORICS 2014: 19th European Symposium on Research in Computer Security, Wroclaw, Poland, September 7-11, 2014. Proceedings, Part II
EditorsMirosław Kutyłowski, Jaideep Vaidya
Number of pages18
ISBN (electronic)9783319112121
ISBN (print)9783319112114
<mark>Original language</mark>English

Publication series

NameLecture Notes in Computer Science
ISSN (Print)0302-9743
ISSN (electronic)1611-3349


We propose a novel technique for detecting P2P botnets. Detection is
based on two working principles. First, we exploit a {\bf fundamental
property} of botnet design: peer-to-peer connectivity topologies are
fundamental to botnet survivability. Second, we use traffic-flow
pattern analysis to capture traffic similarity within a botnet. Our
work unifies graph-theoretic detection with behavioural detection into
a single technique. We carried out evaluation over live P2P botnet
traffic and show that the resulting algorithm can localise the
majority of bots with low false-positive rate.