Hunting for Malicious Infrastructure Using Big Data

This presentation examines two feature-extraction methods for using machine learning to detect anomalies in HTTP responses and identify malicious command-and-control servers. It compares supervised and unsupervised approaches and evaluates header uniqueness and header-order features on public datasets.