Detecting Botnets. Although the research community has presented various works focused on the detection of botnets, the methods discussed in these works have limitations that prevent them from being deployed in modern high- speed networks. These methods either target the detection of particular types of botnets (e.g. the detection of particular IRC patterns in botnet communications) or they provide very complex and resource-intensive algorithms (e.g. multidimensional clustering of the network traffic) that cannot be used for the real-time monitoring of high-speed networks. Instead botnet detection should provide real-time time outputs to network administrators both in an intra-domain and multi-domain environment. It should be able to detect both existing, known botnet networks and new botnet types. In addition, it should provide an option to perform an implementation of proposed algorithms in the existing network infrastructure and connect the detection system outputs with the existing alert systems. The detection itself would use following resources, available in the JRA2 Task 4 environment: IP flow traffic data in NetFlow format. The proposed methods will process the NetFlow data as the main source of information about the current state of the monitored network. The aggregation of the network traffic in the form of NetFlow data enables network traffic analysis to be performed at high speeds in real time (see Finding Patterns of Bad Traffic in NetFlow Data on page 16), compared to the inspection of packets payload, which is very resource-intensive and not suitable for GÉANT. Threat detection results from the honeypots (see Deploying Honeypots on page 9). Information from both inter-domain and intra-domain environments. Internet alerts that provide lists of known sources of bad traffic (see Internet Alerts on page 7). The following list of NetFlow-based anomaly detection methods are suitable for the real-time detection of botnet networks in high-speed networks. Detection of communication between known botnet C&C centres and bots. This detection method exploits the knowledge about known botnet C&C centres and provides a list of suspicious hosts (potential bots) in the monitored network in real time. It periodically retrieves the current lists of known C&C centres both from the deployed honeypots (see Deploying Honeypots on page 9) and from the Internet alert centres (see Internet Alerts on page 7), processes the current NetFlow traffic and reports new suspicious hosts in the ...
