Patent ID: 8307459
Filing Date: 2012-11-06
Classification: H04L

Abstract:
1. A botnet detection system, comprising: a bursty feature extractor, implemented by a computer, receiving an Internet Relay Chat (IRC) packet value from a detection object network, and determining a bursty feature accordingly; a Hybrid Hidden Markov Model (HHMM) parameter estimator, implemented by the computer, determining probability parameters for a Hybrid Hidden Markov Model according to the bursty feature; a traffic profile generator, implemented by the computer, establishing a probability sequential model for the Hybrid Hidden Markov Model according to the probability parameters and pre-defined network traffic categories; a dubious state detector, implemented by the computer, determining a traffic state corresponding to a network relaying the IRC packet in response to reception of a new IRC packet, determining whether the IRC packet flow of the detection object network is dubious by applying the bursty feature to the probability sequential model for the Hybrid Hidden Markov Model, and generating a warning signal when the IRC packet flow is regarded as having a dubious traffic state, wherein the dubious state detector comprises: