Next Article in Journal
FastText-Based Intent Detection for Inflected Languages
Previous Article in Journal
Improving Intrusion Detection Model Prediction by Threshold Adaptation
Article Menu
Issue 5 (May) cover image

Export Article

Open AccessArticle

P2P Botnet Detection Based on Nodes Correlation by the Mahalanobis Distance

Institute of Information and Navigation, Air Force Engineering University, Xi’an 710077, China
Author to whom correspondence should be addressed.
Information 2019, 10(5), 160;
Received: 7 February 2019 / Revised: 7 April 2019 / Accepted: 9 April 2019 / Published: 1 May 2019
(This article belongs to the Section Information and Communications Technology)
PDF [3118 KB, uploaded 1 May 2019]


Botnets are a common and serious threat to the Internet. The search for the infected nodes of a P2P botnet is affected by the number of commonly connected nodes, with a lower detection accuracy rate for cases with fewer commonly connected nodes. However, this paper calculates the Mahalanobis distance—which can express correlations between data—between indirectly connected nodes through traffic with commonly connected nodes, and establishes a relationship evaluation model among nodes. An iterative algorithm is used to obtain the correlation coefficient between the nodes, and the threshold is set to detect P2P botnets. The experimental results show that this method can effectively detect P2P botnets with an accuracy of >85% when the correlation coefficient is high, even in cases with fewer commonly connected nodes. View Full-Text
Keywords: P2P botnet; Mahalanobis distance; correlation coefficient P2P botnet; Mahalanobis distance; correlation coefficient

Figure 1

This is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited (CC BY 4.0).

Share & Cite This Article

MDPI and ACS Style

Yang, Z.; Wang, B. P2P Botnet Detection Based on Nodes Correlation by the Mahalanobis Distance. Information 2019, 10, 160.

Show more citation formats Show less citations formats

Note that from the first issue of 2016, MDPI journals use article numbers instead of page numbers. See further details here.

Related Articles

Article Metrics

Article Access Statistics



[Return to top]
Information EISSN 2078-2489 Published by MDPI AG, Basel, Switzerland RSS E-Mail Table of Contents Alert
Back to Top