On the Internal Workings of Botnets: A Review

Abstract

Denial of Service and Distributed Denial of Service Attacks have significantly shackled the development of computer networks and the internet, and masked their innumerable benefits behind many hours of service unavailability. These attacks are fostered, especially in their distributed variant, by networks of compromised machines (known as botnets, that is, a network of bots) that are taken over by a hacker / attacker, and coordinated in such a way as to channel overwhelming loads of malicious or useless traffic towards resource-providing / request-servicing servers. In the long run, a sufficient load of these traffic, overwhelm target servers and constitute them unable to service the requests of legitimate users that have subscribed legally to use these resources. This army of compromised systems have also been recently linked to various malicious and nefarious activities that have been taking place on computer networks and the internet in recent times; such activities relate to malware injection / infiltration, fraud, espionage, amongst others. This paper reviews the operations and coordination of botnets and the interactions that take place within the botnet during such malicious activities. New, valuable insights are provided towards the detection of such malicious networks through the introduction of the reverse life cycle of botnets.

A Botnets Circumspection: The Current Threat Landscape, and What We Know So Far

“…The generic stages involved in the lifecycle of a typical botnet are shown in Figure 4. Botnets generally undergo the stages of Infection/Doping, Recruitment & Rallying, and Synchronisation & Reporting during its lifetime, as shown in Figure 4, which is adapted from insights provided by Ogu, et al [43]. botmaster arguably may consider as the most important stage.…”

“…At this stage of the botnet lifecycle, newer targets with similar vulnerabilities are acquired and enumerated as members of the botnet [6,8]. Figure 4, which is adapted from insights provided by Ogu, et al [43].…”