Bot networks are a serious threat to cyber security, whose destructive behavior affects network performance directly. Detecting of infected HTTP communications is a big challenge because infected HTTP connections are clearly merged with other types of HTTP Traffic. Cybercriminals prefer to use the web as a communication environment to launch application layer attacks and secretly engage in forbidden activities, while TLS (Transport Layer Security) protocols allow encrypted communication between client and server in the context of Internet provides. Methods of analyzing Traffic behavior do not depend on payloads. This means that they can work with encrypted network communication protocols. Traffic behavior Analysis methods do not depend on package shipments, which means they can work with encrypted network communication protocols. Hence, the Analysis of TLS and HTTP Traffic behavior has been considered for detecting malicious activities. Because of the exchange of information in the network context is very high and the volume of information is very large, storing and indexing of this massive data require a Big data platform.

Analyzing motion patterns in Traffic videos can be employed directly to generate high-level descriptions of their content. For Traffic videos captured from intersections, usually, we can easily provide additional information about Traffic phases. Such information can be obtained directly from the Traffic lights or through Traffic lights controllers. In this paper, we focus on incorporating additional information to analyze the Traffic videos more efficiently. Using side information on Traffic phases, the semantic of motion patterns from Traffic intersection scenes can be learned more effectively. The learning is performed based on optical flow features extracted from training video clips, and applying them to supervised topic models such as MedLDA and MedSTC. Based on such models, any video clip can be represented based on the learned patterns. Such representations can be further exploited in scene Analysis, rule mining, abnormal event detection, etc. Our experiments show that employing side information in intersection video Analysis leads to improvement in discovering scene pattern. Moreover, supervised topic models achieve about 4% improvement in abnormal event detection, compared to the unsupervised ones, in terms of area under ROC.

Fast and accurate network Traffic identification is becoming essential for network management, high quality of service control and early detection of network Traffic abnormalities. Techniques based on statistical features of packet flows have recently become popular for network classification due to the limitations of traditional port and payload based methods. In this paper, we propose a method to identify network Traffics. In this method, for cleaning and preparing data, we perform effective preprocessing approach. Then effective features are extracted using the behavioral Analysis of application. Using the effective preprocessing and feature extraction techniques, this method can effectively and accurately identify network Traffics. For this purpose, two network Traffic databases namely UNIBS and the collected database on router are analyzed. In order to evaluate the results, the accuracy of network Traffic identification using proposed method is analyzed using machine learning techniques. Experimental results show that the proposed method obtains an accuracy of 97% in network Traffic identification.

Today, botnets have become a serious threat to enterprise networks. By creation of network of bots, they launch several attacks, distributed denial of service attacks (DDoS) on networks is a sample of such attacks. Such attacks with the occupation of system resources, have proven to be an effective method of denying network services. Botnets that launch HTTP packet flood attacks against Web servers are one of the newest and most troublesome threats in networks. In this paper, we present a system called HF-Blocker that detects and prevents the HTTP flood attacks. The proposed system, by checking at the HTTP request in three stages, a Java-based test, check cookies and then check the user agent, detects legitimate source of communication from malicios source, such as botnets. If it is proved the source of connection to be bot, HF-Blocker blocks the request and denies it to access to resources of the web server and thereby prevent a denial of service attack. Performance Analysis showed that HF-Blocker, detects and prevents the HTTP-based attacks of botnets with high probability.