Botnet Detection Through Periodic Patterns in Command-and-Control Network Traffic
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F63839172%3A_____%2F25%3A10133872" target="_blank" >RIV/63839172:_____/25:10133872 - isvavai.cz</a>
Alternative codes found
RIV/68407700:21240/25:00386912
Result on the web
<a href="http://dx.doi.org/10.23919/CNSM67658.2025.11297465" target="_blank" >http://dx.doi.org/10.23919/CNSM67658.2025.11297465</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.23919/CNSM67658.2025.11297465" target="_blank" >10.23919/CNSM67658.2025.11297465</a>
Alternative languages
Result language
angličtina
Original language name
Botnet Detection Through Periodic Patterns in Command-and-Control Network Traffic
Original language description
Detecting botnet Command-and-Control (C&C) communication in encrypted network traffic is a persistent challenge in cybersecurity, particularly in environments without endpoint visibility. We present a novel approach for botnet detection based on the inherent periodic communication patterns of C&C channels. Leveraging the Lomb-Scargle periodogram, we identify periodic behaviour in multiflow time series and extract periodic-based features for classification using machine learning. To address limitations in existing datasets, we introduce CESNET-CC25, a comprehensive and publicly available dataset comprising real-world botnet C&C traffic and benign traffic collected from an ISP backbone and controlled laboratory settings. Our method achieves high precision across both the widely used CTU-13 dataset and CESNET-CC25, with significant improvements in recall on long-duration captures. The results demonstrate that periodicity is a reliable indicator of C&C behaviour, even in modern, encrypted network environments, and that CESNET-CC25 provides a realistic benchmark for future botnet detection research.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)
Result continuities
Project
Result was created during the realization of more than one project. More information in the Projects tab.
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)
Others
Publication year
2025
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
Proceedings of the 2025 21th International Conference on Network and Service Management CNSM 2025
ISBN
978-3-903176-75-1
ISSN
2165-963X
e-ISSN
—
Number of pages
6
Pages from-to
—
Publisher name
IEEE
Place of publication
Bologna, Italy
Event location
Bologna, Italy
Event date
Oct 27, 2025
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
—