  Malicious users try to compromise systems using new techniques. One of the
recent techniques used by the attacker is to perform complex distributed
attacks such as denial of service and to obtain sensitive data such as password
information. These compromised machines are said to be infected with malicious
software termed a "bot". In this paper, we investigate the correlation of
behavioural attributes such as keylogging and packet flooding behaviour to
detect the existence of a single bot on a compromised machine by applying (1)
Spearman's rank correlation (SRC) algorithm and (2) the Dendritic Cell
Algorithm (DCA). We also compare the output results generated from these two
methods to the detection of a single bot. The results show that the DCA has a
better performance in detecting malicious activities.
