A Novel Ensemble Anomaly based Approach for Command and Control Channel Detection

The C&C Channel is an indispensable characteristic of botnet. Recognizing and blocking the C&C Channel is of great importance to eliminate the threats of botnet. To overcome the limitation of major behavior based methods, we propose a new ensemble anomaly based approach, which only uses the normal traffic for training. It consists of two detectors which profile and analysis the behavior deviations from different aspects. It has the advantages of reducing the false alarms of traditional anomaly detectors and improving the detection performance. We evaluated it on 5 different datasets and achieved good detection performance.