Botnet detection system and method

1. A botnet detection method, comprising:

retrieving a network log file of a computer device;

refining the network log file according to a device alive-time record of the computer device and a network white list to obtain a plurality of individual network log files, wherein each individual network log file records time information, a source IP address of the computer device, and an individual destination IP address;

calculating an average value and a standard deviation of the connection intervals of the source IP address connecting to the individual destination IP address in each individual network log file;

calculating a connection frequency feature value of each individual network log file by dividing the standard deviation by the average value;

determining whether the computer device exhibits connection behavior that indicates infection by a botnet malware according to the calculated connection frequency feature value;

if the connection frequency feature value of each individual network log file is larger than the predetermined threshold, determining that the computer device does not exhibit connection behavior that indicates infection by the botnet malware; and

if the connection frequency feature value of each individual network log file is smaller than the predetermined threshold, determining that the computer device exhibits connection behavior that indicates infection by the botnet malware.

2. The botnet detection method as claimed in claim 1 , further comprising:

determining whether the connection frequency feature value is smaller than a predetermined threshold.

3. A botnet detection system, comprising:

a memory unit, for storing a botnet detection program; and

a processor, configured to retrieve a network log file of a computer device, and execute the botnet detection program to analyze the network log file,

wherein the processor refines the network log file according to a device alive-time record of the computer device and a network white list to obtain a plurality of individual network log files, wherein each individual network log file records time information, a source IP address of the computer device, and an individual destination IP address,

wherein the processor further calculates an average value and a standard deviation of the connection intervals in each individual network log file, calculates a connection frequency feature value of each individual network log file by dividing the standard deviation by the average value,

wherein the processor further determines whether the computer device exhibits connection behavior that indicates infection by a botnet malware according to the calculated connection frequency value;

if the connection frequency feature value of each individual network log file is larger than the predetermined threshold, determining that the computer device does not exhibit connection behavior that indicates infection by the botnet malware; and

if the connection frequency feature value of each individual network log file is smaller than the predetermined threshold, determining that the computer device exhibits connection behavior that indicates infection by the botnet malware.

4. The botnet detection system as claimed in claim 3 , wherein the processor further determines whether the connection frequency feature value is smaller than a predetermined threshold.

5. The botnet detection system as claimed in claim 4 , wherein the processor further determines that the computer device does not exhibit connection behavior that indicates infection by the botnet malware if the connection frequency feature value of each individual network log file is larger than the predetermined threshold, and

the processor further determines that the computer device exhibits connection behavior that indicates infection by the botnet malware if the connection frequency feature value of each individual network log file is smaller than the predetermined threshold.