Myoungji Han  Jihyuk Lim  Junyong Choi  Hyunjoon Kim  Jungjoo Seo  Cheol Yu  Sung-Ryul Kim  Kunsoo Park

Malicious traffic DDoS attack Botnet clustering metrics

Malicious traffic, such as DDoS attack and botnet communications, refers to traffic that is generated for the purpose of disturbing internet networks or harming certain networks, servers, or hosts. As malicious traffic has been constantly evolving in terms of both quality and quantity, there have been many researches fighting against it. In this paper, we propose an effective malicious traffic detection method that exploits the X-means clustering algorithm. We also suggest how to analyze statistical characteristics of malicious traffic and to define metrics that are used when clustering. Finally, we verify effectiveness of our method by experiments with two released traffic data.