Hybrid Botnet Detection Based on Host and Network Analysis

<table class="table-group" id="tab4"><tr><td><table class="table"><tr><td class="thead-hr" colspan="3"><hr/></td></tr><tr class="thead"><td class="align_left">Classification</td><td class="align_center">RequestPacketSize</td><td class="align_center">ResponsePacketSize</td></tr><tr><td class="thead-hr" colspan="3"><hr/></td></tr><tr><td class="align_left">Abnormal</td><td class="align_center"><svg height="7.88973pt" id="M1" style="vertical-align:-0.6370101pt" version="1.1" viewbox="-0.0498162 -7.25272 15.4189 7.88973" width="15.4189pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M512 -3V55L134 254V256L512 456V514L75 281V230L512 -3Z"></path></g><g transform="matrix(.013,0,0,-0.013,7.631,0)"><path d="M535 323V373H52V323H535ZM535 138V188H52V138H535Z"></path></g></svg>500 bytes</td><td class="align_center"><svg height="7.88973pt" id="M2" style="vertical-align:-0.6370101pt" version="1.1" viewbox="-0.0498162 -7.25272 15.4189 7.88973" width="15.4189pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M512 -3V55L134 254V256L512 456V514L75 281V230L512 -3Z"></path></g><g transform="matrix(.013,0,0,-0.013,7.631,0)"><path d="M535 323V373H52V323H535ZM535 138V188H52V138H535Z"></path></g></svg>500 bytes</td></tr><tr><td class="align_left">Normal</td><td class="align_center"><svg height="7.88973pt" id="M3" style="vertical-align:-0.6370101pt" version="1.1" viewbox="-0.0498162 -7.25272 15.4189 7.88973" width="15.4189pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M512 -3V55L134 254V256L512 456V514L75 281V230L512 -3Z"></path></g><g transform="matrix(.013,0,0,-0.013,7.631,0)"><path d="M535 323V373H52V323H535ZM535 138V188H52V138H535Z"></path></g></svg>500 bytes</td><td class="align_center"><svg height="7.88973pt" id="M4" style="vertical-align:-0.6370101pt" version="1.1" viewbox="-0.0498162 -7.25272 7.75925 7.88973" width="7.75925pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M512 230V281L75 514V456L453 256V254L75 55V-3L512 230Z"></path></g></svg>500 bytes</td></tr><tr class="table-tr"><td colspan="3"><hr class="tbody-hr"/></td></tr></table></td></tr></table>

<div>Example of HTTP request and response ranges sizes.</div>

Journal of Computer Networks and Communications

tab4

Table 4

Table 4: Hybrid Botnet Detection Based on Host and Network Analysis 