A Hybrid Association Rule-Based Method to Detect and Classify Botnets

Table 4

Selection of global correlation features.

Category	Description
TTL value	A recorded survival time
	NS recorded survival time
The diversity of ASN	Diversity of ASN (autonomous domain number) of IP address in a record
	Diversity of ASN (autonomous domain number) of IP addresses in NS records
Number of IP addresses	Number of IP addresses in the a record
	Number of name server IP addresses in NS records