# US 10,122,738 B2 · Botnet detection system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,122,738 B2
- Document ID: US10122738B2
- Status: Granted
- Kind: B2
- Application number: 15/215,311
- Filed: 2016-07-20
- Published: 2017-10-26
- Granted: 2018-11-06
- Earliest claimed: 2016-04-25
- Assignees: Acer Incorporated
- Applicants: Acer Incorporated
- Inventors: Ming-Kung Sun; Chiung-Ying Huang; Zong-Cyuan Jhang
- Web page: https://patentgrep.com/patent/US10122738B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 2463/144: Detection or countermeasures against botnets
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A botnet detection system and method are provided. The method includes the steps of: retrieving a network log file of a computer device; refining the network log file according to a device alive-time record of the computer device and a network white list to obtain a plurality of individual network log files, wherein each individual network log file records time information, a source IP address of the computer device, and an individual destination IP address; and analyzing a plurality of connection intervals of the source IP address connecting to the individual destination IP address in each individual network log file to determine whether the computer device exhibits connection behavior that indicates infection by a botnet malware.

## Claims

### Claim 1

A botnet detection method, comprising:
retrieving a network log file of a computer device;
refining the network log file according to a device alive-time record of the computer device and a network white list to obtain a plurality of individual network log files, wherein each individual network log file records time information, a source IP address of the computer device, and an individual destination IP address;
calculating an average value and a standard deviation of the connection intervals of the source IP address connecting to the individual destination IP address in each individual network log file;
calculating a connection frequency feature value of each individual network log file by dividing the standard deviation by the average value;
determining whether the computer device exhibits connection behavior that indicates infection by a botnet malware according to the calculated connection frequency feature value;
if the connection frequency feature value of each individual network log file is larger than the predetermined threshold, determining that the computer device does not exhibit connection behavior that indicates infection by the botnet malware; and
if the connection frequency feature value of each individual network log file is smaller than the predetermined threshold, determining that the computer device exhibits connection behavior that indicates infection by the botnet malware.

### Claim 2 (depends on 1)

The botnet detection method as claimed in claim 1, further comprising:
determining whether the connection frequency feature value is smaller than a predetermined threshold.

### Claim 3

A botnet detection system, comprising:
a memory unit, for storing a botnet detection program; and
a processor, configured to retrieve a network log file of a computer device, and execute the botnet detection program to analyze the network log file,
wherein the processor refines the network log file according to a device alive-time record of the computer device and a network white list to obtain a plurality of individual network log files, wherein each individual network log file records time information, a source IP address of the computer device, and an individual destination IP address,
wherein the processor further calculates an average value and a standard deviation of the connection intervals in each individual network log file, calculates a connection frequency feature value of each individual network log file by dividing the standard deviation by the average value,
wherein the processor further determines whether the computer device exhibits connection behavior that indicates infection by a botnet malware according to the calculated connection frequency value;
if the connection frequency feature value of each individual network log file is larger than the predetermined threshold, determining that the computer device does not exhibit connection behavior that indicates infection by the botnet malware; and
if the connection frequency feature value of each individual network log file is smaller than the predetermined threshold, determining that the computer device exhibits connection behavior that indicates infection by the botnet malware.

### Claim 4 (depends on 3)

The botnet detection system as claimed in claim 3, wherein the processor further determines whether the connection frequency feature value is smaller than a predetermined threshold.

### Claim 5 (depends on 4)

The botnet detection system as claimed in claim 4, wherein the processor further determines that the computer device does not exhibit connection behavior that indicates infection by the botnet malware if the connection frequency feature value of each individual network log file is larger than the predetermined threshold, and
the processor further determines that the computer device exhibits connection behavior that indicates infection by the botnet malware if the connection frequency feature value of each individual network log file is smaller than the predetermined threshold.