A Survey on Botnet Command and Control Traffic Detection
نویسندگان
چکیده
Internet users have been attacked by widespread email viruses earlier, but now scenario has been changed. Now attackers are no more interested to just attract media attention by infecting a large number of computers on the network; in fact, their interest has been shifted to compromising and controlling the infected computers for their personal profits. This new attack trend brings the concept of botnets over the global network of computers. With the high reported infection rates, the vast range of illegal activities and powerful comebacks, botnets are one of the main threats against the cyber security. This paper provides the readers with a background on botnet life-cycle, architecture and malicious activities. It also classifies botnet detection techniques, reviews the recent research works on botnet traffic detection and finally indicates some challenges posed to future work on botnet detection. Keywords—Cyber security, malware, botnet, C&C server, intrusion detection system.
منابع مشابه
BotOnus: an online unsupervised method for Botnet detection
Botnets are recognized as one of the most dangerous threats to the Internet infrastructure. They are used for malicious activities such as launching distributed denial of service attacks, sending spam, and leaking personal information. Existing botnet detection methods produce a number of good ideas, but they are far from complete yet, since most of them cannot detect botnets in an early stage ...
متن کاملA Survey on Botnet Architectures, Detection and Defences
Botnets are known to be one of the most serious Internet security threats. In this survey, we review botnet architectures and their controlling mechanisms. Botnet infection behavior is explained. Then, known botnet models are outlined to study botnet design. Furthermore, Fast-Flux Service Networks (FFSN) are discussed in great details as they play an important role in facilitating botnet traffi...
متن کاملA Survey of Botnet Detection Techniques by Command and Control Infrastructure
Botnets have evolved to become one of the most serious threats to the Internet and there is substantial research on both botnets and botnet detection techniques. This survey reviewed the history of botnets and botnet detection techniques. The survey showed traditional botnet detection techniques rely on passive techniques, primarily honeypots, and that honeypots are not effective at detecting p...
متن کاملDetection of Botnet Command and Control Traffic by the Multistage Trust Evaluation of Destination Identifiers
Network-based detection of botnet Command and Control communication is a difficult task if the traffic has a relatively low volume and if popular protocols, such as HTTP, are used to resemble normal traffic. We present a new network-based detection approach that is capable of detecting this type of Command and Control traffic in an enterprise network by estimating the trustworthiness of the tra...
متن کاملA Novel Botnet Detection Based on IP Flows and Time Intervals
Botnet detection is one of the most emerging topic recently. In this article we would like to introduce a novel method based on IP flows to detect botnets through command and control behaviors. This is a combination of both machine learning and regression, which can reduce time interval to monitor network traffic significantly.
متن کاملDetection of Covert Botnet Command and Control Channels by Causal Analysis of Traffic Flows
The Command and Control communication of a botnet is evolving into sophisticated covert communication. Techniques as encryption, steganography, and recently the use of social network websites as a proxy, impede conventional detection of botnet communication. In this paper we propose detection of covert communication by passive hostexternal analysis of causal relationships between traffic flows ...
متن کامل