eldorado.tu-dortmund.de/server/api/core/bitstreams/58953e56-2602-445c-9d85-b32666ab788c/content
Web-Authentisierung mit dem ePA
l3proto, payload), ... }
{ (t, sIP, dIP, sp, dp, l7proto, payload, ...), ... }
{ (t, sIP, dIP, sp, dp, bSent, bRcvd, duration, l7msgsSent, l7msgsRcvd, entropy, l7proto, dnsResolvedDst, dnsFailureRate, ...), [...] (abstraction)? ◦ Network flow-level features (duration, src&dst, ports,
l4proto, l7msgs, bytes sent/rcvd, entropy, dst_domain, l7proto, ...)
Formal definition of a behavior signature? ◦ Aggregation of flows [...] takes place, such as C&C traffic
Attack traffic may support detection
6
2. Discussion of approaches
7
Approach: Flow Based Botnet Detection
Extract features from bot network traffic samples
◦ A) in a …
