Patent Document ID: 20110004936
Application ID: 12726272
Patent Flag: 0

Claim One:
1. A botnet detection system, comprising: a bursty feature extractor, receiving an Internet Relay Chat (IRC) packet value from a detection object network, and determining a bursty feature accordingly; a Hybrid Hidden Markov Model (HHMM) parameter estimator, determining probability parameters for a Hybrid Hidden Markov Model according to the bursty feature; a traffic profile generator, establishing a probability sequential model for the Hybrid Hidden Markov Model according to the probability parameters and pre-defined network traffic categories; a dubious state detector, determining a traffic state corresponding to a network relaying the IRC packet in response to reception of a new IRC packet, determining whether the IRC packet flow of the detection object network is dubious by applying the bursty feature to the probability sequential model for the Hybrid Hidden Markov Model, and generating a warning signal when the IRC packet flow is regarded as having a dubious traffic state.