Analysis and Detection of Botnets and Encrypted Tunnels

A botnet is a collection of compromised systems. A botnet has a bot-master which identifies the vulnerable systems and compromises them by injecting a malware code and remotely controls all these compromised systems using Command-andControl Infrastructure. These compromised systems are bots. Thus, a botnet is a network of bots. These bots receive commands from bot-master to perform various malicious activities like Distributed Denial of Service (DDoS) attack, phishing, sending spam emails etc. Nowadays, Botnets have become a major threat to online ecosystems. Thus, Analysis and detection of the botnets has become a major research topic in recent years. Nowadays, botnets are relying on anonymous networks to hide their existence. Anonymous communication implies that no one will be able to retrieve the identity of the users in the network. The Tor browser is the most widely used anonymous network among botnets. The Tor aims to eliminate the mapping between user and services or servers by hiding the user’s IP address and thereby blocks the user identification and communication tracking. The Tor browser provides anonymity to all of its users. Botnets are now using tor anonymity due to which they hide themselves and it becomes difficult to detect them. The proxy servers are also used to hide the identity of the users. Browsing using Proxy server changes the IP-address of its user due to which backtracking is difficult and it becomes extremely difficult to detect if a chain of proxies is used. This paper aims to identify several ways to reveal the identities of the bots and their bot-master that are using tor or any other anonymous network.