Characterizing Anomalies in Malware-Generated HTTP Traffic

Table 4

List of HTTP requests’ structure features.

---

Feature name

---

HTTP protocol version

Request method

Repetitions of the header (two header fields with the same name)

Lack of colon in the header field

Number of headers in the request

Frequency of the headers’ occurrence

Misspellings of the header names

Presence of request pipelining

TCP destination port in the request

---

Features proposed by the authors of this paper are marked with (an asterisk).