Description

A novel two-stage approach for the important cyber-security problem of detecting the presence of a botnet and identifying the compromised nodes (the bots), ideally before the botnet becomes active. The first stage detects anomalies by leveraging large deviations of an empirical distribution. We propose two approaches to create the empirical distribution: a flow-based approach estimating the histogram of quantized flows, and a graphbased approach estimating the degree distribution of node interaction graphs, encompassing both Erd?os-R´enyi graphs and scale-free graphs.