The Detection of 8 Type Malware botnet using Hybrid Malware Analysis in Executable File Windows Operating Systems

Abstract

Nowadays a lot of botnet are being used for the purpose of cybercrime such as distributed denial of services (DDos) or information stealing. Botnet is a collection of computers connected through Internet that has been taken over by an attacker using malwares. These infected computer are known as bot or zombie. These bot are controllable for the attacker through an infrastructure called Command and Control (C&C) server. In general, the spread of botnets Windows operating system as its main target in the form of executable file (.exe).Right now Windows have a massive number of application in the form of executable file and almost all of it doing connection to the Internet. So it make it very difficult to distinguish an executable file as a malware botnet or not. Therefore, to identify and detecting a malware botnet required malware analysis on Windows executable file. Many ways can be done in analyzing a malware. However, generally speaking there are two techniques in malware analysis. That is static analysis and dynamic analysis. By combining both the results of static analysis, dynamic analysis can produce data for detecting malware botnet in the executable files of Windows operating system that are Herpestnet, Ann Loader, mbot, Vertexnet, Athena, Elite Loader, Gbot, dan Cythosia.

Survey on Representation Techniques for Malware Detection System

“…2, the fact behind this malicious software is that there will be number of computers (Botnets) get infected with a malware known as bots which will send orders through a Command and Control (C and C) to the botnets through its unique characteristic (Lee et al, 2010a). The usage of the botnet was just for the sake of mere vandalism and then it has been switched to financial revenue goals by criminals (Satrya et al, 2015). According to a survey done by Vinod P. and others they have clearly pointed out that the botnet is a remotely-controlled software-collection of autonomous software robots.…”

“…It has been also defined as a malicious code that is designed to hide the presence of other malware. They are usually combined with other malware such as a backdoor, so that remote access could be performed by the attacker so that the detection of it becomes very difficult (Satrya et al, 2015). …”

“…They allow an attacker to connect to a computer with little or no verification and execute a command on the local system (Satrya et al, 2015). It could be further defined as a mechanism which bypasses a normal security check.…”

“…This malicious software informs the user that they are attacked by a virus and the only way to clean it is to buy their software (Satrya et al, 2015). More specifically it could be also defined as malicious computer programs intended to trick a user into buying and downloading needless and possibly dangerous software, such as fake antivirus protection.…”

Improving Network Security - A Comparison of Open Source DPI Software

“…Some effective solutions are vulnerability scanning and penetration testing (Oriyano, 2014) (G. Satrya & Shin, 2015) (G. B. Satrya, Cahyani, & Andreta, 2015). DPI is a software that is able to perform vulnerability scanning up to layer 7 of the OSI layer (Scarfone & Hoffman, 2009).…”