botnet survey

A Survey of Botnets

YongQing Ni, DaeHun Nyang

Information Security Research Laboratory

Graduate School of IT & Telecommunication - InHa University

253 YongHyun-dong, Nam-gu, Incheon 402-751, Korea

niyongqing@gmail.com, nyang@inha.ac.kr

http://seclab.inha.ac.kr

Abstract. In the recent years, botnets have become a big issue on the

internet threaten. As the first botnet which was based on IRC came out,

comparison based on variety of approaches.

Keywords: Botnet, Category, Channel, Peer-to-Peer.

1 Introduction

The botnet is a group of compromised computers working together under the

control of a remote attacker(“botmaster”)[3,4,1], usually for illegal purposes. It

is also a creative attack strategy evolved from traditional malware attacking

forms. In the past several years, malware attacks to the internet are becoming

more and more prevalent all over the world, and the botnet turns into the main

cause of these malicious attacks, such as email spam, Dos/DDos, phishing etc.

approaches to the IRC-based botnet have been proposed. Such as Honeypot[6],

which can be used to track and monitor all the commands issued by attack-

ers, is still being updated and developed by many participators from the world.

GuoFei and his partners proposed a novel monitoring strategy on botnet, named

BotHunter[7] which focuses on recognizing the infection and coordination dia-

log that occurs during a successful mailware infection. Yousof Al-Hammadi and

Uwe Aickelin, they presented to detect the botnet through log correlation[8]. By

monitoring the change of behavior in log files from different hosts, the communi-

cations will be monitored and they can distinguish the normal conversation and

behaviors or abnormal ones.

becomes more serious every day which also leads to a detection storm in the

research community. Julian B. Grizzard et al.[9] provide an overview of P2P-

based botnet and present a specific case study on Trojan.Peacomm bot. Christ

Nunnery and Brent ByungHoon Kang argue locating zombie nodes and botmas-

ters as first step to detect P2P-based botnet. T. Holz et al.[11] propose their

strategy of measurements and mitigation on P2P-based botnet, and they apply

the approach to Storm Worm which is the most wide-spread P2P-based botnet

in the wild. With the new methodology applied in P2P-based botnet detection,

newly build-up P2P-based botnets are also gradually produeced. A advanced

hybrid[13] P2P botnet is proposed by Ping Wang et al. They argue new and

we describes the main detection mechanisms to botnets in Section 3. In Section

4, we present the trend of botnets and future work. Finally, we make a conclusion

in Section 5.

2 A Category of botnets

With the first bot appeared in wild, a variety of botnets are released. Currently,

the botnets have been the biggest threaten to the internet security which aroused

a wide public concern in the security community. Lots of researchers and anti-

virus/malware companies start to study the mechanism of botnets and mitigate

the threaten from the botnets. But till now, there’s no any systematic and detail

investigation and analisis about the structures current wide-spread botnets based

As is well known, Internet Relay Chat(IRC) is a form of real-time communica-

tion system over the internet. But the attackers utilize it to form a botnet for

malicious purposes. They send the bot commands[14] to the infected IRC server,

and the server disperses the bot commands to the all bots logged in the current

server. Thus, the IRC-based botnet is formed. So, in the following paragraph,

in our following analisis: Infection Scheme, Malware Propagation and Self-Protection.

And for each scheme, we will choose three well known bots(AgoBot[15], SDBot,

SpyBot) as our instances to show the details of botnet control mechanism.

derived from the IRC, so the Command language of AgoBot contains Bot Com-

mands and Standard IRC Commands. In Bot Commands Set, there includes all

the request and control commands to achieve specific funcions for attackers. P.

Barford and V. Yegneswaran provide us a detail table of commands [16], we do

not list them any more. We focus on the description of Infection Scheme.