Botnet and Detection Techniques: A Review

Among the diverse forms of malware, Botnet is the most widespread and serious threat which occurs commonly in today's cyber-attacks. A botnet is a group of compromised computers which are remotely controlled by hackers to launch various network attacks, such as DDoS attack, spam, click fraud, identity theft and information phishing. Botnet has become a popular and productive tool behind many cyber-attacks. The defining characteristic of botnets is the use of command and control channels through which they can be updated and directed. Recently malicious botnets evolve into HTTP botnets out of typical IRC botnets. Data mining algorithms allow us to automate detecting characteristics from large amount of data, which the conventional heuristics and signature based methods could not apply

International journal of engineering research and technology, 2018

Recent malicious attempts are intended to get financial benefits through a large pool of compromised hosts, which are called software robots or simply “bots.” A group of bots, referred to as a botnet, is remotely controllable by a server and can be used for sending spam mails, stealing personal information, and launching DDoS attacks. Among the various forms of malware, botnets are emerging as the most serious threat against cyber-security as they provide a distributed platform for several illegal activities such as launching distributed denial of service attacks against critical targets, malware dissemination, phishing, and click fraud. The defining characteristic of botnets is the use of command and control channels through which they can be updated and directed. Recently, botnet detection has been an interesting research topic related to cyber-threat and cyber-crime prevention. This paper is a survey of botnet and botnet detection. The survey clarifies botnet phenomenon and discu...

Botnet comprises of collection of bot-infected computers that allows an attacker to take control and carry out large scale cyber attacks. Botnets have been used to perform various malicious activities such as Distributed Denial of Service (DDoS), information stealing, and cyber physical attacks. Botnets act in a stealthy manner by keeping themselves hidden from the users of compromised systems. In this paper, we present a survey of botnet detection techniques and classify them into four classes: (i) signature-based, (ii) anomaly-based, (iii) data miningbased, and (iv) honeypot-based. We then compare different detection techniques based on their response to unknown bots, encrypted bots, protocol and structure independence, real time detection and accuracy of detection.

IJSRD, 2013

Botnets are emerging as the most serious threat against cyber-security as they provide a distributed platform for several illegal activities such as launching distributed denial of service attacks against critical targets, malware dissemination, phishing, and click fraud. The defining characteristic of botnets is the use of command and control channels through which they can be updated and directed. Recently, botnet detection has been an interesting research topic related to cyber-threat and cyber-crime prevention. This paper is a survey of botnet and botnet detection. The survey clarifies botnet phenomenon and discusses botnet detection techniques. This survey classifies botnet detection techniques into four classes: signature-based, anomaly-based, DNS-based, and mining-base.

2020

Botnet has become thorn for the Internet and the cyber security. Botnets are network of zombies controlled by botherder for their malicious and nefarious activities. These activities include distributed denial of service (DDoS) attack, click fraud, phishing, spamming, malware dissemination, traffic sniffing etc. The botnets are capable of bringing down the whole network within seconds. A number of techniques have been developed to detect the botnet and dismantle them but attackers have shown that they are always ahead of these detection techniques. This paper discusses the evolution of botnet, life cycle of botnet, its architecture and detection techniques. There are numerous detection techniques proposed by researchers that are reviewed on the basis of various parameters in this work. In spite of having such vast amount of detection techniques botnet can’t be tackled because of the dynamic nature of the Internet. The war against botnet can be seen as cat and mouse which is never-en...

IAEME PUBLICATION, 2020

The botnet is one of electronic information and technology's most substantial threats. Because all people throughout the world are discovering new innovations, offenders are exploring new tools to offer crime in different meanings. It is not necessary to be available on the web of the criminal act due to the development of tech offenders. Intruders can target potential users directly and take hold of their passwords to perform multiple harmful operations. Original bots evolved throughout the Web's early years were malignant. The botnet, a system of web-connected manipulating computers operated by an intruder, is known as one of the most devastating risks to security. Whenever a machine is usually damaged by a drive-by-download, which has integrated malware, that machine has become a member of a botnet. A bot usually runs concealed and communicates in its operational server using a secret network. Botnets are managed by protocols like Internet Relay Chat and Hyper Text Transfer Protocol (HTTP) and in a protocol-consistent way which renders it a difficult issue to identify and monitor the botnet command. This paper gives a comprehensive overview of Botnet detection techniques followed by its merits, demerits and features employed in various techniques.

2014

Botnets are emerging as the most serious threat against cyber-security as they provide a distributed platform for several illegal activities such as launching distributed denial of service attacks against critical targets, malware dissemination, phishing, and click fraud. The defining characteristic of botnets is the use of command and control channels through which they can be updated and directed. Recently, botnet detection has been an interesting research topic related to cyber-threat and cyber-crime prevention. This paper is a survey of botnet and botnet detection. The survey clarifies botnet phenomenon and discusses botnet detection techniques. This survey classifies botnet detection techniques into four classes: signature-based, anomaly-based, DNS-based, and mining-base.

2018

Botnets have in recent times, become a very major challenge in the cyberspace. The Global Internet has experienced tremendous attacks designed mainly to disable internet infrastructure on one hand, while in most other cases people and organizations are targeted. At the center of these attacks are a group of compromised computers that have been infested and are now controlled by a Botmaster. These systems are usually located in schools, business premises, homes and government agencies which, unknown to their owners, are infested and controlled by Botmasters for malicious activities. This paper presents an analysis of Botnet with respect to its architectural representation, classification and characterization in order to help coordinate the development of new technologies to face this serious security threat. Index Terms Peer to Peer (P2P), Botnet, Command and Control Channel (C&C), Botnet Detection, Cyber Security

- Botnets are now considered as one of the most serious security threats. In contrast to previous malware, botnets have the characteristics of command and control (C&C) channel. Botnets usually use existing common protocols, eg IRC, HTTP and in protocol conforming manners, this makes the detection of botnet C&C a difficult problem. In this paper we tend to proposed 3 techniques specifically signature based detection, firewall IP blocking and anomaly based detection so as to detect bot and provide secure network services to the users.

A botnet is a network of compromised computers, termed bots that are used for malicious purposes. When a computer becomes compromised typically through a drive-by download, that has embedded malicious software, that computer becomes a part of a botnet. A bot typically runs hidden and uses a covert channel to communicate with its command and control server. Botnets are controlled through protocols such as IRC and HTTP and in protocol-conforming manners. This makes the detection of botnet command and control a challenging problem. In this paper we discuss some of the botnet detection techniques and compare their advantages, disadvantages and features used in each technique.