  Peer-to-peer (P2P) botnets have become one of the major threats in network
security for serving as the fundamental infrastructure for various
cyber-crimes. More challenges are involved in the problem of detecting P2P
botnets, despite a few work claimed to detect centralized botnets effectively.
We propose Enhanced PeerHunter, a network-flow level community behavior
analysis based system, to detect P2P botnets. Our system starts from a P2P
network flow detection component. Then, it uses "mutual contacts" to cluster
bots into communities. Finally, it uses network-flow level community behavior
analysis to detect potential botnets. In the experimental evaluation, we
propose two evasion attacks, where we assume the adversaries know our
techniques in advance and attempt to evade our system by making the P2P bots
mimic the behavior of legitimate P2P applications. Our results showed that
Enhanced PeerHunter can obtain high detection rate with few false positives,
and high robustness against the proposed attacks.
