A Taxonomy of Botnet Behavior, Detection, and Defense

Khattak, Sheharbano; Ramay, Naurin Rasheed; Khan, Kamran Riaz; Syed, Affan A.; Khayam, Syed Ali

doi:10.1109/surv.2013.091213.00134

Cited by 156 publications

(143 citation statements)

References 53 publications

Supporting

Mentioning

133

Contrasting

Unclassified

Order By: Relevance

“…Other early studies discussed and evaluated the scale and the takedown techniques of a botnet. Both Dagon et al [2] and Khattak et al [25] discussed how different kinds of botnets are organized and what activities they may have. Abu Rajab et al focused on botnet scale evaluation [1], and StoneGross et al addressed detailed issues of taking down a botnet [26].…”

Section: Related Workmentioning

confidence: 99%

Detecting Web-Based Botnets Using Bot Communication Traffic Features

Hsu

Hwang

et al. 2017

Security and Communication Networks

View full text Add to dashboard Cite

Web-based botnets are popular nowadays. A Web-based botnet is a botnet whose C&C server and bots use HTTP protocol, the most universal and supported network protocol, to communicate with each other. Because the botnet communication can be hidden easily by attackers behind the relatively massive HTTP traffic, administrators of network equipment, such as routers and switches, cannot block such suspicious traffic directly regardless of costs. Based on the clients constituent of a Web server and characteristics of HTTP responses sent to clients from the server, this paper proposes a traffic inspection solution, called Web-based Botnet Detector (WBD). WBD is able to detect suspicious C&C (Command-and-Control) servers of HTTP botnets regardless of whether the botnet commands are encrypted or hidden in normal Web pages. More than 500 GB real network traces collected from 11 backbone routers are used to evaluate our method. Experimental results show that the false positive rate of WBD is 0.42%.

show abstract

Section: Related Workmentioning

confidence: 99%

Detecting Web-Based Botnets Using Bot Communication Traffic Features

Hsu

Hwang

et al. 2017

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Researchers have infiltrated botnets [12] and documented insider perspectives [48]. Readers interested in comprehensive surveys of the botnet phenomenon are directed to [49] [50].…”

Section: Prior Workmentioning

confidence: 99%

ZombieCoin: Powering Next-Generation Botnets with Bitcoin

Ali

McCorry

Lee

et al. 2015

Financial Cryptography and Data Security

View full text Add to dashboard Cite

Abstract. Botnets are the preeminent source of online crime and arguably the greatest threat to the Internet infrastructure. In this paper, we present ZombieCoin, a botnet command-and-control (C&C) mechanism that runs on the Bitcoin network. ZombieCoin offers considerable advantages over existing C&C techniques, most notably the fact that Bitcoin is designed to resist the very regulatory processes currently used to combat botnets. We believe this is a desirable avenue botmasters may explore in the near future and our work is intended as a first step towards devising effective countermeasures.

show abstract

“…On the other hand, information about legal flux service is more genuine detailed. Consequently, a fast-flux attack holds the following poor quality (Al-Duwairi and Al-Hammouri, 2014; Celik & Oktug, 2013;Futai, Siyu, & Weixiong, 2013;Gržnić, Perhoč, Marić, Vlašić, & Kulcsar, 2014;Hao et al, 2011;Hsu, Huang, & Chen, 2010;Hsu et al, 2014, Huang, Mao, & Lee, 2010Khattak, Ramay, Khan, Syed, & Khayam, 2014;Lin, Lin, & Chiang, 2013;Mahjoub, 2013;Martinez-Bea, Castillo-Perez, & GarciaAlfaro, 2013;Paul, Tyagi, Manoj, & Thanudas, 2014;Shen, Wu, Yang, & Huang, 2013;Stalmans, Hunter, & Irwin, 2012;Wang, Mao, Wu, & Lee, 2012;Yadav, Reddy, Narasimha Reddy, & Ranjan, 2012):…”

Section: Characterizing Fast-flux Attackmentioning

confidence: 99%

“…As discussed in Celik and Oktug (2013), Hsu et al (2014), the ICANN Technique Report (2009), Khattak et al (2014), and Konte et al (2008Konte et al ( , 2009, there are kinds of fast-flux that can occur at different network locations. Formally modeling fast-flux attack can help us to investigate the features and behaviors of these flux attacks.…”

Section: Future Challenges 81 Modeling Fast-flux Attacksmentioning

confidence: 99%

A Survey on Fast-flux Attacks

Zhou

2015

Information Security Journal: A Global Perspective

View full text Add to dashboard Cite

Fast-flux" refers to rapidly assigning different IP addresses to the same domain name. Although there are some legitimate uses for this technique, recently it has become a favorite tool for cyber criminals to launch collaborative attacks. After it was first observed by Honeynet, it was reported that fast-flux has been used in phishing, malware spreading, spam, and other malicious activities linked to criminal organizations. Combining with peer-to-peer networking, distributed command and control, web-based load balancing, and proxy redirection, fast-flux makes Internet attacks more resistant to discovery and counter-measure. This article aims at giving a comprehensive survey on fast-flux attacks. Some important issues including technical background, classification, characterization, measurement and detection, and mitigation are discussed. Challenges of detecting and mitigating fast-flux attack are also pointed out.

show abstract

A Taxonomy of Botnet Behavior, Detection, and Defense

Cited by 156 publications

References 53 publications

Detecting Web-Based Botnets Using Bot Communication Traffic Features

Detecting Web-Based Botnets Using Bot Communication Traffic Features

ZombieCoin: Powering Next-Generation Botnets with Bitcoin

A Survey on Fast-flux Attacks

Contact Info

Product

Resources

About