Detection of botnets before activation: an enhanced honeypot system for intentional infection and behavioral observation of malware

Abstract

As botnets have become the primary means for cyber attacks, how to detect botnets becomes an important issue for researchers and practitioners. In this study, we introduce a system that is designed to detect botnets prior to their activation. Pre‐detection of botnets becomes available with our enhanced honeypot system that allows us to intentionally infect virtual machines in honeynets. For empirical testing, we applied our system to a major Internet service provider in Korea. After running our proposed system for 12 months, it was found that nearly 40% of blacklisted botnets were pre‐detected by our system before their attacks begin. We expect that our system can be used to detect command‐and‐control servers and to screen them out during their propagation stage before they make harmful attacks. Copyright © 2012 John Wiley & Sons, Ltd.

A Botnets Circumspection: The Current Threat Landscape, and What We Know So Far

“…Examples of implementations of the honeypot technique towards countering botnets can be found in sources such as Al-Hakbani and Dahshan (2015) [91], Daniel and Hongmei (2013) [92] and Moon et al [93]. As adapted based on insights received from Barfar et al [94], Figure 5 illustrates a basic (naïve) deployment of honeypots.…”

A Hybrid Defense Technique for ISP Against the Distributed Denial of Service Attacks

“…On the other hand, the types of application-based defense mechanisms are much more numerous: client-puzzle [37], IRC-based [23], anomaly-based [10] [27], DNS tracking [25], and attack traffic suppression [24]. In addition to these traditional defense methods, advanced defense methods, such as reverse engineering [20] and honeypot [29] [31], also exist. We divide our literature review below into three parts.…”

“…A honeypot-based proactive defense is more effective and efficient for blocking DDoS attacks [29]. Moon et al introduced the hybrid honeypot system, which enables the ISP to find the C&C structured botnet before it initiates an attack.…”

“…Exploiting these crucial data, the ISP can block the server IP addresses or URLs by disabling the routing from their network infrastructure. After a 12-month experimental period, over 40% of malicious server IPs and URLs were identified and blocked before their bot masters commanded attacks [29].…”

Survey on network‐based botnet detection methods

“…Botnets are detected using different characteristics of the network traffic, for example, using networks statistics , communication protocols , suspicious traffic behavior , graphical representations of behaviors , actions in honeypots , behavioral features , collaborative feedback in large networks and malicious actions . However, botnets evolve and thus make obsolete most detection methods.…”