Honeynet Based Botnet Detection Using Command Signatures

Abstract

Abstract. Global Internet threats are undergoing a profound transformation from attacks designed solely to disable infrastructure to those that also target people and organizations. This alarming new class of attacks directly impacts the day to day lives of millions of people and endangers businesses and governments around the world. At the centre of many of these attacks is a large pool of compromised computers located in homes, schools, businesses, and governments around the world. Attackers use these zombies as anonymous proxies to hide their real identities and amplify their attacks. Bot software enables an operator to remotely control each system and group them together to form what is commonly referred to as a zombie army or botnet. A botnet is a network of compromised machines that can be remotely controlled by an attacker. In this we propose an approach using honeynet data collection mechanisms to detect IRC and HTTP based botnet. We have evaluated our approach using real world network traces. Keywords:We would like to encourage you to list your keywords in this section.

Solutions for counteracting human deception in social engineering attacks

“…During that same time, global internet threats transitioned from disabling infrastructure to targeting people and organizations, endangering businesses and governments (Bhatia et al , 2011). Developments in technology included common security infrastructure and intrusion detection systems designed to detect multiple operating systems in information technology (Bhatia et al , 2011).…”

“…During that same time, global internet threats transitioned from disabling infrastructure to targeting people and organizations, endangering businesses and governments (Bhatia et al , 2011). Developments in technology included common security infrastructure and intrusion detection systems designed to detect multiple operating systems in information technology (Bhatia et al , 2011). Honeypot data collection technologies, computer or network services used as traps for detecting and detouring robot networks (botnets), were discussed along with their developmental importance for the future of IS (Bhatia et al , 2011).…”

A Botnets Circumspection: The Current Threat Landscape, and What We Know So Far

“…The primary goal of most Analysis-Based techniques is to detect, (and in some cases, prevent) the presence of botnets or bot activity in the network. One way by which this is achieved is by comparing certain characteristics of network traffic with a database of attributes (signatures) that have already been associated with specific botnet behaviours, such as those proposed by Zand et al [73], Bilge et al [74] and Bhatia et al [75]. Furthermore, as seen in the literature, another technique seeks to analyse network traffic for traffic/packets that exhibit behaviours that deviate from the normal, observable network behaviour (an anomaly), such as those proposed by Wang et al [76], Boukhtouta et al [77], Zhao et al [78] and Caglayan et al [79].…”