A multifaceted approach to understanding the botnet phenomenon

Abstract

The academic community has long acknowledged the existence of malicious botnets, however to date, very little is known about the behavior of these distributed computing platforms. To the best of our knowledge, botnet behavior has never been methodically studied, botnet prevalence on the Internet is mostly a mystery, and the botnet life cycle has yet to be modeled. Uncertainty abounds. In this paper, we attempt to clear the fog surrounding botnets by constructing a multifaceted and distributed measurement infrastructure. Throughout a period of more than three months, we used this infrastructure to track 192 unique IRC botnets of size ranging from a few hundred to several thousand infected end-hosts. Our results show that botnets represent a major contributor to unwanted Internet traffic-27% of all malicious connection attempts observed from our distributed darknet can be directly attributed to botnetrelated spreading activity. Furthermore, we discovered evidence of botnet infections in 11% of the 800,000 DNS domains we examined, indicating a high diversity among botnet victims. Taken as a whole, these results not only highlight the prominence of botnets, but also provide deep insights that may facilitate further research to curtail this phenomenon.

An Analysis of Rogue AV Campaigns

“…Also, we have seen how such campaigns often lead to the automated deployment of large numbers of domains pointing to a few servers and following well-defined patterns in their naming schema. For all these reasons, as already noted in [20] for other type of threats, DNS seems to be a promising point of view for the detection of such anomalies.…”

“…For example, in the context of spam botnets, researchers have used spam messages [31] and DNS queries [20,22] as proxy indicators of infected machines. Active approaches are also possible.…”

“…Clients from all around the world interacted with the rogue AV servers. The countries that were most visiting them were USA (147,729 distinct client IPs), UK (20,275), and Italy (12,413). Some rogue AV sites appear to be more popular than others, in terms of the distinct client IP addresses that were served by each.…”

Mobile Botnets Development: Issues and Solutions

“…In the arena of attacks exploiting network nodes, botnets [4] represent an important resource for cybercrime organizations. In particular, a botnet is a network of infected hosts (known as bots, agents, or zombies) under the control of a bot-master that can send specific attack commands to the bots in order to carry out distributed and coordinated operations [5], typically (but not only) aimed at launching cyber-attacks.…”

Analysis on the Sequential Behavior of Malware Attacks

“…Highly organized and coordinated attacks by botnets are able to make malicious activities such as distributed denial of service (DDoS), e-mail spam, and click fraud [2]. A set of infected and compromised computers (bots) connected to the Internet is controlled remotely by an unauthorized user (botmaster) and, if employed for nefarious purposes, is called a botnet [3]- [5]. To scale up the botnet, bots infect additional computers by sending malware, using various strategies such as self-replicating worms, email viruses, or password guessing.…”