Abstract

Botnets have emerged as one of the biggest threats to internet security in the recent years. They have confounded security researchers because of their mobile and secretive behavior. A Botnet is a network of zombie machines remotely controlled by a command server or a Botmaster. These compromised host machines may be used for sending spam, launching DOS attacks, spying or stealing information. As botnets have evolved, so has the detection techniques changed. A number of different techniques have been suggested yet no technique is completely foolproof. While some are based on detecting anomalies, others focus on DNS queries [Choi et al. , 2007] or DNSBL [Ramachandran et al. , 2006] queries etc. This paper analyzes layouts of different detection techniques. The paper tries to find features that, when combined together, complement each other's strengths and eliminate the weaknesses and suggests a framework consisting of a combination of those features which, theoretically, should overcome most of the common problems faced by detection techniques.

References

• N. Feamster, A. Ramachandran and D. Dagon, "Revealing botnet membership using dnsbl counter-intelligence," in The 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet (SRUTI '06), 2006.
• W. Li, S. Xie, J. Luo, Xiaodong Zhu,A Detection Method for Botnet based on Behavior Features, Proceedings of the 2nd International Conference On Systems Engineering and Modeling (ICSEM-2013), 2013
• Hossein Rouhani Zeidanloo,Azizah Bt Abdul Manaf, "Botnet Detection by Monitoring Similar Communication Patterns",(IJCSIS) International Journal of Computer Science and Information Security,Vol. 7, No. 3, March 2010,pp. 36- 45.
• H. Choi, H. Lee, and H. Kim. Botnet detection by monitoring group activities in dns traffic. In proceedings of the 7th IEEE International Conference on Computer and Information Technology(CIT'07), Washington, DC, October 2007.
• Robiah Y, Siti Rahayu S. , Mohd Zaki M. , Shahrin S. , Faizal M. A. , Marliza R. ;A New Generic Taxonomy on Hybrid Malware Detection Technique. (IJCSIS) International Journal of Computer Science and Information Security, Vol. 5, No. 1, 2009
• G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee. BotHunter: Detecting malware infection through ids-driven dialog correlation. In Proceedings of the 16th USENIX Security Symposium (Security'07), 2007.
• G. Gu, R. Perdisci, J. Zhang, and W. Lee, "Botminer: Clustering analysis of network traffic for protocol- and structure independent Botnet detection," in Proc. 17th USENIX Security Symposium, 2008.
• T. Karagiannis, K. Papagiannaki, and M. Faloutsos, "BLINC:multilevel traffic classification in the dark," In Proceedings of the 2005 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, pp. 229-240, Philadelphia, Pennsylvania, 2005