No abstract

Botnets have evolved to become one of the most serious threats to the Internet and there is substantial research on both botnets and botnet detection techniques. This survey reviewed the history of botnets and botnet detection techniques. The survey showed traditional botnet detection techniques rely on passive techniques, primarily honeypots, and that honeypots are not effective at detecting peer-to-peer and other decentralized botnets. Furthermore, the detection techniques aimed at decentralized and peer-to-peer botnets focus on detecting communications between the infected bots. Recent research has shown hierarchical clustering of flow data and machine learning are effective techniques for detecting botnet peer-to-peer traffic.

This chapter explores the cybercrime-as-a-service operations that have changed the cybercrime marketplace from a direct sales model to a managed service model. As cybercrime evolved, so did the motivation and skill of the hackers. What began as a highly skilled activity undertaken by individuals driven by curiosity and research grew to a horde of lightly trained yet motivated young people looking for notoriety and/or a quick profit as tools became easier to use and more readily available. As the ability to profit from cybercrime grew exponentially, hackers began to sell their services, and eventually it was more profitable and less risky to sell a packaged cybercrime as a service than commit the crime. The cybercrime-as-a-service operations now involve many types of cybercrime including botnets, distributed denial of service attacks (DDoS), credit card fraud, malware, spam, and phishing attacks. The services are sold through hacker forums, direct web sales, and on the dark web using cryptocurrency. The world's law enforcement agencies have recognized the threat of cybercrime-as-a-service operations, and there have been recent high-profile arrests of the operators and takedowns of the cybercrime-as-a-service operations.

No abstract

No abstract