A Botnet Migration Analyzer Based on the C-F Model

This paper analyzes several features in the progress of botnet migration and proposes a botnet migration analyzer for analyzing botnet migration based on C-F model.The analyzer fuses these features to decide whether a botnet migrates to another one.Several typical bot samples have been used to evaluate the mothed,most of these bot migration behavior have been identified.Such result is better than the method of decide botnet migration only by the size of duplicated IP addresses.