Online IRC botnet detection using a SOINN classifier

Abstract

IRC botnets have been rapidly growing in number, in infected network hosts, and, most of all, in size of caused damages. Hence, there is the need of a real-time detection solution, as accurate as possible; the earlier a botnet is discovered, the smaller will be its potential impact. In order to tackle these issues, our approach to IRC Botnet detection considers both the online context and the time consumption problem. In particular, we use both statistical and digrams-based features to build a two-class behavioral model. Then, we setup a fast detection engine based on an unsupervised incremental learning method. Several tests performed on real data (botnet and non-botnet IRC channels) revealed the effectiveness of the entire proposed solution.