Botnets

Abstract

Recent malicious attempts are intended to get financial benefits through a large pool of compromised hosts, which are called software robots or simply bots. A group of bots, referred to as a botnet, is remotely controllable by a server and can be used for sending spam emails, stealing personal information, and launching DDoS attacks. Growing popularity of botnets compels to find proper countermeasures, but existing defense mechanisms hardly catch up with the speed of botnet technologies. Bots are constantly and automatically changing their signatures to successfully avoid the detection. Therefore, it is necessary to analyze the weaknesses of existing defense mechanisms to find the gap and then design new framework of botnet detection that integrates effective approaches. To get a deep insight into the inner-working of botnets and to understand their architecture, the authors analyze some sophisticated sample botnets. In this chapter, they propose a comprehensive botnet analysis and reporting framework that is based on sound theoretical background.