Cloud Computing for Malicious Encrypted Traffic Analysis and Collaboration

2. Background And Related Work

Botnets are one of the most serious security threats today. Many cybercrimes are related to botnets such as DDoS, click fraud, phishing, spamming, sniffing traffic and spreading new malware (Anwar et al., 2014). The botmaster or botherder can use the C&C servers to remotely control the compromised hosts by installing a RAT (Remote Administration Tool or Remote Access Trojan). The C&C communication techniques are based on IRC, HTTP and P2P protocols. Many researches focus on C&C communication detection (Chen et al., 2017; Hong et al., 2015a; Hong et al., 2015b; Jeng et al., 2018; Sun et al., 2017), but most of them have no solution for detecting malicious encrypted traffic. More recently, attackers have used encrypted channels or covert communication mechanisms instead of plaintext transmission. For example, C&C traffic can occur through pages and images on online social networks, covert DNS traffic, and Tor (The Onion Router) (Gardiner et al., 2014).