Patent ID: 8578493

Claim:
A method for identifying a botnet in a network, comprising: obtaining a first plurality of flows each having a flow size less than a first pre-determined threshold and comprising a tuple of <source Internet Protocol (IP) address, destination IP address, server port, protocol>; comparing, by a hardware processor, the destination IP address and each IP address in a pre-determined well known IP list to determine that the destination IP address is not included in the well known IP list; analyzing, by the hardware processor, a plurality of timestamps of the first plurality of flows to determine an average period and a variance of the average period; generating an alert in response to the average period being within a pre-determined range and the variance being less than a second pre-determined threshold; the method further comprising: repetitively obtaining a plurality of network traffic data sets each obtained at one of a plurality of recurring time points, wherein each network traffic data set comprises a second plurality of flows each having a flow size exceeding a third pre-determined threshold and comprising a particular <source IP address, destination IP address> pair; analyzing each of the plurality of network traffic data sets based on a pre-determined exfiltration rule set to generate an exfiltration detection result at each of the plurality of recurring time points, wherein the pre-determined exfiltration rule set comprises a plurality of thresholds; modifying, in response to at least one element of the particular <source IP address, destination IP address> pair matching the alert, the pre-determined exfiltration rule set to generate a modified exfiltration rule set by reducing at least one threshold of the plurality of thresholds; and detecting an exfiltration event based on the modified exfiltration rule set.