Botnets Detection by Analyzing Network Traffic Group Activities and Unsuccessful Responses

Botnets are one of the growing threats on the Internet and computer networks. Botnet is a network of infected computers connected to the Internet, which is controlled by a control server, and used for Internet attacks such as denial of service attacks, and spams. Botnets expand the their territory by identifying vulnerable devices on the network and get them to compromise. They are progressing rapidly and use new technologies such as DNS and quick continuous changes, to trap their users and enhance the protection of infected computers. One of the quick continuous changes is using a domain name generation algorithm. By using this method attackers prevent, control server domain names to be in black lists. Many Botnet detection methods are based on an analysis of group activity, but using this method alone does not have sufficient performance in small and medium networks. The aim of this paper is to provide a comprehensive and complete method to detect Botnets that use quick domain name changes algorithmivckly. Our method is capable of detecting Botnets that work in this way. In this method Botnets are detected based on failed responses or NXDomain in each host. This feature increase detection accuracy in small and medium networks. Our method is tested in infected networks with Conficker and Kraken and information obtained from them has been analyzed.