What is C&C Server

A botnet is a network of malware-infected systems called bots that are controlled by a botmaster through a command and control channel. Various types of crimes are done by the botmaster with the help of these bots. Botmasters can use HTTP protocol for the C&C channel as majority of the internet traffic uses HTTP and hence are allowed in most of the networks. Effectively, bots hide their communication within the normal HTTP traffic as it is not easy to block this service as a precautionary measure. This fact makes the HTTP-based C&C communication stealthier. This work proposes a technique to collect and analyse HTTP botnets. In this work a framework was developed in order to build HTTP botnets in a controlled environment. Signatures of the bots that were set up are also obtained. Further analysis was done using machine learning-based classification as well as periodicity analysis. The results demonstrate the superior detection performance of the proposed method with 100% accuracy and detection rate.