Botzilla

Abstract

Hosts infected with malicious software, so called malware, are ubiquitous in today's computer networks. The means whereby malware can infiltrate a network are manifold and range from exploiting of software vulnerabilities to tricking a user into executing malicious code. Monitoring and detection of all possible infection vectors is intractable in practice. Hence, we approach the problem of detecting malicious software at a later point when it initiates contact with its maintainer; a process referred to as "phoning home". In particular, we introduce Botzilla, a method for detection of malware communication, which proceeds by repetitively recording network traffic of malware in a controlled environment and generating network signatures from invariant content patterns. Experiments conducted at a large university network demonstrate the ability of Botzilla to accurately identify malware communication in network traffic with very low false-positive rates.

CluSiBotHealer: Botnet Detection through Similarity Analysis of Clusters

“…Among the current botnet detection systems implemented for real network environment we have many well-known signature-based techniques [9]- [11]. Signature based detection leads to accurate detection of bots through comparison of every byte in the packet with that of known signature database.…”

Malware behavior

“…Botzilla [126] uses a network signature detection scheme that is closely related to part of our work, since we also perform our network traffic detection step based on invariant content patterns. Botzilla's goal is to detect malware "phoning home", i.e.…”