Botnet detection techniques: review, future trends, and issues

Abstract

In recent years, the Internet has enabled access to widespread remote services in the distributed computing environment; however, integrity of data transmission in the distributed computing platform is hindered by a number of security issues. For instance, the botnet phenomenon is a prominent threat to Internet security, including the threat of malicious codes. The botnet phenomenon supports a wide range of criminal activities, including distributed denial of service (DDoS) attacks, click fraud, phishing, malware distribution, spam emails, and building machines for illegitimate exchange of information/materials. Therefore, it is imperative to design and develop a robust mechanism for improving the botnet detection, analysis, and removal process. Currently, botnet detection techniques have been reviewed in different ways; however, such studies are limited in scope and lack discussions on the latest botnet detection techniques. This paper presents a comprehensive review of the latest state-of-the-art techniques for botnet detection and figures out the trends of previous and current research. It provides a thematic taxonomy for the classification of botnet detection techniques and highlights the implications and critical aspects by qualitatively analyzing such techniques. Related to our comprehensive review, we highlight future directions for improving the schemes that broadly span the entire botnet detection research field and identify the persistent and prominent research challenges that remain open.

A Comprehensive Study of Email Spam Botnet Detection

“…The most important challenge in this regard is that these approaches are performed stealthy and can put at risk the security of the very hosts they inquire about to protect. If this offensive detection is discovered by the botmaster, there is a possibility that he/she will direct attack traffic to the responsible host(s) in defy defense [31].…”

“…Although the subject of botnet and botnet detection has gained a lot of attention and thus, there are several surveys on botnets [12][13][14] [20][21][22][23][24][25][26][27][28][29][30][31] in the literature but all of them cover the botnet problem in general, discussing different aspects like botnet phenomenon, botnet detection techniques and countermeasures. Also what was missing in these surveys is that all of these studies review only a few of all the research efforts intended only for detecting Email spamming botnets.…”

From botnets to MobiBots: a novel malicious communication paradigm for mobile botnets

“…Communication defense consists of detecting and identifying malicious communication between the infected bots and their C&C servers, and isolating the botnet by reporting and shutting down the detected C&C server. Researchers have proposed many detection techniques based on honeynets [7] and/or intrusion detection [8].…”

“…Such systems search for network traffic anomalies, such as high network delays, high traffic throughput, and suspicious port usage [8].…”

“…Attacker View: Upon receiving C&C messages, the botnet enters the attack phase where a group of recruited bots are asked to initiate a specific malicious activity such as DDoS, spam, click fraud, and phishing attacks [8]. The ultimate goal of a botnet is to successfully and stealthily execute the planned attack.…”