Abstract—Botnets have caused significant security threat and huge loss to organizations. Bot masters control the botnet through command and control servers (C2 servers); they often adopt the most commonly used communication channel, HTTP, in order to blend in malicious communication messages into massive normal traffic for detection evasion purpose. By analyzing malicious and normal traffic, this study discovered the anomalies of the botnet communication patterns. Botnet connections exhibit some similarity behaviors which are not possessed by normal traffic. This study develops an anomaly score function to represent the anomalies and proposes a botnet detection method based on a revised ant colony optimization algorithm. The experimental results show that the proposed anomaly botnet detection method identifies botnets efficiently.

Index Terms—Botnet, anomaly detection, ant colony optimization.

Chia-Mei Chen is with Department of Information Management National Sun Yat-Sen University, Kaohsiung, Taiwan. Wen-Ling Lo is with Department of Technology Crime Investigation Taiwan Police College, Taipei, Taiwan. Ya-Hui Ou, Gu-Hsin Lai, and Tse-Yao Wang are with Department of Aviation & Communication Electronic Air Force Institute of Technology, Kaohsiung, Taiwan.

Cite:Chia-Mei Chen, Wen-Ling Lo, Ya-Hui Ou, Gu-Hsin Lai, Tse-Yao Wang, "Application of Revised Ant Colony Optimization for Anomaly Detection Systems," International Journal of Computer and Electrical Engineering vol. 10, no. 3, pp. 241-247, 2018.