A method for identification of IRC Botnets' control commands based on syntax features

To solve the problem of detection of an IRC Botnet's control commands, a syntax feature-based identification method is presented. The method, firstly, analyzes the lexical features of keywords and parameters of IRC Botnet control commands, and then unifies them for input processing. Secondly, starting from the features of syntax structures such as the type and amount of parameters, three kinds of control commands' formalized grammar descriptions are defined to fit different syntax structures, furthermore a prototype system based on the LR parsing technique is designed and implemented. The availability of the method was verified by experiment and the experimental results showed that the grammar had the good ability in recognizing the Botnet control commands, and its performance met the pactical requirement.