A Survey of Botnet Technology and Defenses

Bailey, Michael; Cooke, Evan; Jahanian, Farnam; Xu, Yunjing; Karir, Manish

doi:10.1109/catch.2009.40

Cited by 166 publications

(96 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Unfortunately, botnets have grown in sophistication to use Peer-to-Peer (P2P) and unstructured communication [10,19]. In addition to the traditional techniques such as blacklisting, both signature and anomaly-based detection, and DNS traffic analysis, BotHunter [15] proposes using infection models to find bots, while BotMiner [14] analyzes aggregated network traffic.…”

Section: Related Workmentioning

confidence: 99%

NetGator: Malware Detection Using Program Interactive Challenges

Schulte

Andrianakis

Sun

et al. 2013

Detection of Intrusions and Malware, and Vulnerability Assessment

View full text Add to dashboard Cite

Abstract. Internet-borne threats have evolved from easy to detect denial of service attacks to zero-day exploits used for targeted exfiltration of data. Current intrusion detection systems cannot always keep-up with zero-day attacks and it is often the case that valuable data have already been communicated to an external party over an encrypted or plain text connection before the intrusion is detected. In this paper, we present a scalable approach called Network Interrogator (NetGator) to detect network-based malware that attempts to exfiltrate data over open ports and protocols. NetGator operates as a transparent proxy using protocol analysis to first identify the declared client application using known network flow signatures.Then we craft packets that "challenge" the application by exercising functionality present in legitimate applications but too complex or intricate to be present in malware. When the application is unable to correctly solve and respond to the challenge, NetGator flags the flow as potential malware. Our approach is seamless and requires no interaction from the user and no changes on the commodity application software. NetGator introduces a minimal traffic latency (0.35 seconds on average) to normal network communication while it can expose a wide-range of existing malware threats.

show abstract

Section: Related Workmentioning

confidence: 99%

NetGator: Malware Detection Using Program Interactive Challenges

Schulte

Andrianakis

Sun

et al. 2013

Detection of Intrusions and Malware, and Vulnerability Assessment

View full text Add to dashboard Cite

show abstract

“…The current work is based on results of three directions of research: analysis of botnets as a phenomenon occurred in the Internet [2,6,8,19,21], including the studies of botnet taxonometry, approaches of creation and improving the techniques for counteraction against modern botnets, and enhancement of concepts and methods for efficient modeling and simulation of botnet infrastructure and counteraction.…”

Section: Related Workmentioning

confidence: 99%

Discrete-Event Simulation of Botnet Protection Mechanisms

Kotenko¹,

Konovalov²,

Shorov³

2012

Discrete Event Simulations - Development and Applications

View full text Add to dashboard Cite

“…For example, Bailey et al [2] survey botnet technology and Dagon et al [5] examine malware that changes a client's DNS resolver, including the Zlob trojan.…”

Section: Related Workmentioning

confidence: 99%

An Assessment of Overt Malicious Activity Manifest in Residential Networks

Maier

Feldmann

Paxson

et al. 2011

Detection of Intrusions and Malware, and Vulnerability Assessment

View full text Add to dashboard Cite

Abstract. While conventional wisdom holds that residential users experience a high degree of compromise and infection, this presumption has seen little validation in the way of an in-depth study. In this paper we present a first step towards an assessment based on monitoring network activity (anonymized for user privacy) of 20,000 residential DSL customers in a European urban area, roughly 1,000 users of a community network in rural India, and several thousand dormitory users at a large US university. Our study focuses on security issues that overtly manifest in such data sets, such as scanning, spamming, payload signatures, and contact to botnet rendezvous points. We analyze the relationship between overt manifestations of such activity versus the "security hygiene" of the user populations (anti-virus and OS software updates) and potential risky behavior (accessing blacklisted URLs). We find that hygiene has little correlation with observed behavior, but risky behavior-which is quite prevalent-more than doubles the likelihood that a system will manifest security issues.

show abstract

A Survey of Botnet Technology and Defenses

Cited by 166 publications

References 10 publications

NetGator: Malware Detection Using Program Interactive Challenges

NetGator: Malware Detection Using Program Interactive Challenges

Discrete-Event Simulation of Botnet Protection Mechanisms

An Assessment of Overt Malicious Activity Manifest in Residential Networks

Contact Info

Product

Resources

About