Characterizing Anomalies in Malware-Generated HTTP Traffic

Table 7

List of HTTP request payload features.

---

Feature name

---

Payload data length

Payload entropy value

Presence of non-ASCII characters in the payload

Presence of non-POST requests with the payload

Presence of Referer header in the POST request

---

Features proposed by the authors of this paper are marked with (an asterisk).