Recognizing P2P Botnets Characteristic Through TCP Distinctive Behaviour.

!
" #
$ !
,

-

.!

%

+

/

&'()) *

!!

+

+

0.

3

,
!
: :)()

9

+

3
#

!
$

!
!

%

"
!

""!

#

!

!

!

!
!

!

$

33

!

+

8

3

2
3

=8:8>
!

+ #
$ 8

!

!

!

2

!

#
!

"

# +

8:8

3:3

#

+

+*

1 2

3 3
2 #

#

$ 2 #
8

3

#
43
2
3
2

2

+
!

5

#

#

3

3
#
43

3

5

!

# +

!

#
#

7

#

2

!
+
3 3

+
!

!
!
8

3 #
8:8

+

!

2
2
8
!

!

6
2

!
33

#

!
3

3 3

8:8

8:8
33
+

#
#

!

3

3

!

!

" "

+ ,

2

3

'

" "
!

() *

>

(+
2
2

&!
! !
"

3
;( :<

#

!
'" "

=
,
3
(&?

:&&

#
#"

+

#

#

! 3
+
2

+
3

#

8:8

2+

:

@
! !
+

!
8:8
3

8:8

!

!

8:8
!

A+

B
2

)

& -. +,*

#
!

(- 8

!
,

6

9
;( :<

+

3 3 3
8:8
+
3

: :)()

!
2

2

7

!

8

#

5
#
4

#
2
+

#
!

!

33
#

3 #

,

!
3

+

2

!

http://sites.google.com/site/ijcsis/
ISSN 1947-5500

3

43

4

#

2

+
!

!

F 3

"#
!
B3

;@<
!

2 3
# #

!

#
!
!

3

;A<

2

!
+

!

2
!
!

#

#

!!

!
3
2

!

=

>

+

3 3

;((
>
>
>

#
3
8

!

!#

-

8
1 =$ M3 >
= 3+ ! OO:>
8
1P F
= 3+ ! OO(K>
8 1
= 3+ ! OO(>
8Q
= 3+ ! OOA(>
8 1"HH
= 3+ ! OO)>
3

#

!

2
!

3
8:8+

+

3 3
8:8

!

7 ) ; +
5
+ ;M
<
#
%
:)((
3-PP
+
! +
E
#
+ =:))L>+
" $
,
*
5
;M
<
#
:)((
3-PP
+
! +
P 2P
P) :KL(A: (AT!
(@AL:K:T
( ))+
,
G+ +N 1
+N X
#
"
6
X 7 & + #! 4
#
+
87## 9
)5
# +
+ 33+')(7')A L7() % + :)()
E 7$2 H N
7
!
!N
X8
8
6
*
" !*
!
X
) 5
+
!
# +
+ 33+(7A
:)7:: !+ :)()
I+ ,+ V ,1
7 7M
*
+W
3
" -E
8
! :)((
,
$+ =:)()>+ %
) ! +1
+ ! +
%
;M
<
#
:)((
3-PP
+ !3 +
P:))KP):P
!7
!7
373 7(+
$
+ +
+ =:)()>+ V 8 3
2
8:8
6
*
+W
)
( +
+
) 5
+ G +: 1 +: 3 :)()
* H N
HN
$ N
!2 H !N X 8:876
!
2
X
) 5
+
- +
( +
+
)-(
# +(
+ 33+BB7BK L7() M + :)()
V
*
C
1 2
*
W+ 8 + *+
+ " #
:))L
9

http://sites.google.com/site/ijcsis/
ISSN 1947-5500