Patent ID: 8533819
Filing Date: 2013-09-10
Classification: H04L

Abstract:
1. A method for detecting a botnet, comprising: identifying, by a processor, a plurality of candidate bots, wherein the plurality of candidate bots is selected from a plurality of suspicious hosts, and wherein the identifying comprises identifying a set of hosts from the plurality of suspicious hosts that have established a connection to a hub-server, wherein the hub-server comprises an internet relay chat server, wherein the connection is associated with a local port of the hub-server and a respective remote Internet protocol address of each host of the set of hosts; analyzing, by the processor, network traffic of the plurality of candidate bots to identify a plurality of suspect controllers, wherein the analyzing comprises analyzing network traffic of the plurality of suspicious hosts that are identified as a candidate bot to identify a plurality of suspicious hub-servers, wherein the analyzing is performed in view of a local internet protocol address, the local port of the hub-server, a respective remote internet protocol address of each suspicious host of the plurality of suspicious hosts that is identified as a candidate bot, and a respective remote port of each of the plurality of suspicious hosts that is identified as a candidate bot; classifying, by the processor, the plurality of candidate bots into a group; identifying, by the processor, members of the group that are connected to a same controller from the plurality of suspect controllers, where the members are identified to be part of the botnet; and performing, by the processor, packet tracing to confirm the botnet, wherein the packet tracing validates that a controller of the plurality of suspect controllers is used for control of the botnet.