Botnet Research Survey
Published 1 January 2008
Zhaosheng Zhu, Guohan Lu, Yan Chen, Zhi Fu, Phil Roberts, Keesook J. Han
Citations175
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
A survey of recent advances in botnet research, which classifies the botnets research into three areas: understanding botnets, detecting and trackingBotnets, and defending against botnets.
Abstract
Botnets are emerging threat with hundreds of millions of computers infected. A study shows that about 40% of all computers connected to the internet in the world are infected bots and controlled by attackers. This article is a survey of recent advances in botnet research. The survey classifies the botnet research into three areas: understanding botnets, detecting and tracking botnets, and defending against botnets. While botnets are widespread, the research and solutions for botnets are still in their infancy. The paper also summarizes the existing research and proposes future directions for botnet research.
Keywords
Computer Science
Journal of Bioresource ManagementBotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection
1,023 Citations2008Guofei Gu, Roberto Perdisci +2 more
This paper presents a general detection framework that is independent of botnet C&C protocol and structure, and requires no a priori knowledge of botnets (such as captured bot binaries and hence the botnet signatures, and C &C server names/addresses).
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic
707 Citations2008Guofei Gu, Junjie Zhang +1 more
This paper proposes an approach that uses network-based anomaly detection to identify botnet C&C channels in a local area network without any prior knowledge of signatures or C &C server addresses, and shows that BotSniffer can detect real-world botnets with high accuracy and has a very low false positive rate.
BotHunter: detecting malware infection through IDS-driven dialog correlation
691 Citations2007Guofei Gu, Phillip Porras +3 more
A new kind of network perimeter monitoring strategy, which focuses on recognizing the infection and coordination dialog that occurs during a successful malware infection, and contrast this strategy to other intrusion detection and alert correlation methods.
A multifaceted approach to understanding the botnet phenomenon
604 Citations2006Moheeb Abu Rajab, Jay Zarfoss +2 more
This paper attempts to clear the fog surrounding botnets by constructing a multifaceted and distributed measurement infrastructure, which shows that botnets represent a major contributor to unwanted Internet traffic and provides deep insights that may facilitate further research to curtail this phenomenon.
ACM SIGCOMM Computer Communication ReviewUnderstanding the network-level behavior of spammers
520 Citations2006Anirudh Ramachandran, Nick Feamster
Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm
373 Citations2008Thorsten Holz, Moritz Steiner +3 more
In a case study, the Storm Worm botnet is examined in detail, the most wide-spread P2P botnet currently propagating in the wild, and two different ways to disrupt the communication channel between controller and compromised machines in order to mitigate the botnet are presented.
Peer-to-peer botnets: overview and case study
349 Citations2007J.B. Grizzard, Vikram Sharma +3 more
An overview of peer-to-peer botnets is presented and a case study of a Kademlia-based Trojan is presented, which shows how attackers will move to more resilient architectures in the near future.
Network and Distributed System Security SymposiumModeling Botnet Propagation Using Time Zones.
337 Citations2006David Dagon, Cliff C. Zou +1 more
A diurnal propagation model is created that uses diurnal shaping functions to capture regional variations in online vulnerable populations and lets one compare propagation rates for different botnets, and prioritize response.
Conference on Workshop on Hot Topics in Understanding BotnetsWide-scale botnet detection and characterization
323 Citations2007Anestis Karasaridis, Brian Rexroad +1 more
The approach presented here differs from previous attempts to detect botnets by employing scalable non-intrusive algorithms that analyze vast amounts of summary traffic data collected on selected network links.
Rishi: identify bot contaminated hosts by IRC nickname evaluation
303 Citations2007Jan Goebel, Thorsten Holz
A simple, yet effective method to detect bot-infected machines within a given network that relies on detection of the communication channel between bot and Command & Control server (C&C server).
Advances in information securityAn Inside Look at Botnets
289 Citations2007Paul Barford, Vinod Yegneswaran
A significant change in motivation for malicious activity has taken place over the past several years: from vandalism and recognition in the hacker community, to attacks and intrusions for financial gain, thereby escalating the network security arms race.
Lecture notes in computer scienceBotnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks
288 Citations2005Felix Freiling, Thorsten Holz +1 more
This paper presents an approach to (distributed) DoS attack prevention that is based on the observation that coordinated automated activity by many hosts needs a mechanism to remotely control them and shows that this method can be realized in the Internet by describing how it infiltrated and tracked IRC-based botnets.
A Taxonomy of Botnet Structures
258 Citations2007David Dagon, Guofei Gu +2 more
This work proposes a taxonomy of botnet structures, based on their utility to the botmaster, and proposes key metrics to measure their utility for various activities (e.g., spam, ddos).
IEEE Transactions on Dependable and Secure ComputingAn Advanced Hybrid Peer-to-Peer Botnet
257 Citations2009Ping Wang, Sherri Sparks +1 more
This paper presents the design of an advanced hybrid peer-to-peer botnet, which provides robust network connectivity, individualized encryption and control traffic dispersion, limited botnet exposure by each bot, and easy monitoring and recovery by its botmaster.
Conference on Workshop on Hot Topics in Understanding BotnetsMy botnet is bigger than yours (maybe, better than yours): why size estimates remain challenging
222 Citations2007Moheeb Abu Rajab, Jay Zarfoss +2 more
It is shown how several issues, including cloning, temporary migration, and hidden structures significantly increase the difficulty of determining botnet size with any accuracy.
Revealing botnet membership using DNSBL counter-intelligence
206 Citations2006Anirudh Ramachandran, Nick Feamster +1 more
It is found that bots are performing reconnaissance on behalf of other bots, and counterintelligence techniques that may be useful for early bot detection are suggested.
The anatomy of Clickbot.A
157 Citations2007Neil Daswani, Michael Stoppelman
This paper provides a detailed case study of the architecture of the Clickbot, a botnet that attempted a low-noise click fraud attack against syndicated search engines using a HTTP-based botmaster.
Conference on Workshop on Hot Topics in Understanding BotnetsA case study of the rustock rootkit and spam bot
133 Citations2007Ken Chiang, Levi Lloyd
A case study of the steps leading up to the extraction of the spam bot payload found within a backdoor rootkit known as Backdoor.Rustock.c.
Network and Distributed System Security SymposiumArmy of Botnets
99 Citations2007Ryan Vogt, John Aycock +1 more
This work examines the possibility of “super-botnets,” networks of independent botnets that can be coordinated for attacks of unprecedented scale, and sheds light on the feasibility and structure of super-botsnets and some properties of their command-and-control mechanism.
Conference on Workshop on Hot Topics in Understanding BotnetsA distributed content independent method for spam detection
40 Citations2007Alex Brodsky, Dmitry Brodsky
A distributed, content independent, spam classification system that is specifically aimed at botnet generated spam and can be used in combination with existing spam classifiers and distributed in order to provide a robust defense against denial-of-service attacks from the very same botnets.