Botnets (networks of compromised computers) are often used for malicious activities such as spam, click fraud, identity theft, phishing, and distributed denial of service (DDoS) attacks. Most of previous researches have introduced fully or partially signature-based botnet detection approaches. In this paper, we propose a fully anomaly-based approach that requires no a priori knowledge of bot signatures, botnet C&C protocols, and C&C server addresses. We start from inherent characteristics of botnets. Bots connect to the C&C channel and execute the received commands. Bots belonging to the same botnet receive the same commands that causes them having similar netflows characteristics and performing same attacks. Our method clusters bots with similar netflows and attacks in different time windows and perform correlation to identify bot infected hosts. We have developed a prototype system and evaluated it with real-world traces including normal traffic and several real-world botnet traces. The results show that our approach has high detection accuracy and low false positive.

Imbalanced datasets are datasets with different samples distribution in which the distribution of samples in one class is scientifically more than other class samples. Learning a classification model for such imbalanced data has been shown to be a tricky task. In this paper we will focus on learning classifier systems, and will suggest a new XCS-based approach for learning classification models from imbalanced data sets. The main idea behind the suggested approach is to update the important parameters of the learning method based on the information gathered in each step of learning, in order to provide a fair situation for the minor class, to contribute in building the final model. We have also evaluated our approach by testing it with real-world known imbalanced datasets. The results show that our new algorithm has a high detection rate and a low false positive rate.