Characterizing Anomalies in Malware-Generated HTTP Traffic

<div>An example of the Suricata IDS rule based on presented observations. The rule detects <i>POST</i> requests in 1.0 version of the protocol without the <i>Referer</i> header.</div>

Security and Communication Networks

fig11

Figure 11

Figure 11: Characterizing Anomalies in Malware-Generated HTTP Traffic 