DOCSLIB.ORG

Survey of Peer-To-Peer Botnets and Detection Frameworks

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Survey of Peer-To-Peer Botnets and Detection Frameworks International Journal of Network Security, Vol.20, No.3, PP.547-557, May 2018 (DOI: 10.6633/IJNS.201805.20(3).18) 547 Survey of Peer-to-Peer Botnets and Detection Frameworks Ramesh Singh Rawat1;2, Emmanuel S. Pilli3 and R. C. Joshi1 (Corresponding author: Emmanuel S. Pilli) Department of Computer Science and Engineering, Graphic Era University, Dehradun, India1 Department of Computer Science and Engineering, Uttarakhand Technical University, Dehradun, India2 Department of Computer Science and Engineering, Malaviya National Institute of Technology, Jaipur, India3 (Email: [email protected]) (Received Feb. 18, 2017; revised and accepted June 25, 2017) Abstract launch attacks at global scale. Botnets are the largest threat to the cyber security of government, industries, Botnet is a network of compromised computers controlled academia and critical infrastructure etc. [4]. These pro- by the attacker(s) from remote locations via Command vide large distributed platform to perform various ma- and Control (C&C) channels. The botnets are one of the licious activities such as distributed denial-of- service largest global threats to the Internet-based commercial (DDoS), spamming, phishing, spying, click-fraud, bitcoin and social world. The decentralized Peer-to-Peer (P2P) mining, brute force password attacks and compromising botnets have appeared in the recent past and are grow- social media service [10]. ing at a faster pace. These P2P botnets are continu- Many papers have surveyed the research literature of ously evolving from diverse C&C protocols using hybrid botnets [13, 18, 20, 26], but to the best of our knowl- structures and are turning to be more complicated and edge, there is no schematic, analytical & comprehensive stealthy. In this paper, we present a comprehensive sur- survey on the emerging P2P botnets and the detection vey of the evolution, functionalities, modelling and the methods. In this paper, we exclusively discuss various development life cycle of P2P botnets. Further, we in- aspects of P2P botnets including: evolution, character- vestigate the various P2P botnet detection approaches. istics, C&C architecture and various detections methods. Finally, discuss the key research challenges useful for the The paper is useful in understanding the characteristics of research initiatives. This paper is useful in understanding P2P botnets and the classification of the various detection the P2P botnets and gives an insight into the usefulness techniques. It has the following important contributions: and limitations of the various P2P botnet detection tech- niques proposed by the researchers. The study will enable • The timeline of evolution and development life cycle the researchers toward proposing the more useful detec- of P2P botnets is presented; tion techniques. • The characteristics, architecture and functionalities Keywords: Botnet Architecture; Detection Frameworks; of P2P botnets are described; Hybrid Botnets; Peer-to-Peer Botnets; Traffic Analysis • The taxonomy and analytical survey of the various 1 Introduction detection frameworks and models is presented; • A discussion of the research challenges in detection Botnet is a network of compromised computers that are and defence of these botnets is also included. illicitly controlled and secretly used by attackers for var- ious malicious operations. The attacker controlling the The remainder of the paper is organized from Section 2 botnet is called bot master or bot herder. The compro- to Section 7. Section 2 covers the background and related mised computers in a botnet are called drones or zombies surveys. The botnet architecture and C&C protocols are and the malicious software running on them is known as discussed in Section 3. In Section 4, we have categorized bot. The term "bot" is derived from the word "robot" the various detection frameworks. Further, the detection and it is a program used to automate tasks [8]. techniques are investigated in Section 5. In Section 6, we Botnets comprise of large pool of thousand to millions have presented the identified research challenges. Finally, of compromised computers which empower the attackers Section 7 presents the summary and directions for future with huge computational power and large band-width to research work. International Journal of Network Security, Vol.20, No.3, PP.547-557, May 2018 (DOI: 10.6633/IJNS.201805.20(3).18) 548 2 Background Unstructured Botnet: Use P2P overlay links established arbitrarily and maintain neighboring peers list to Attackers exploit number of vulnerabilities and use social ensure connectivity. This architecture is inherently engineering techniques to infect more and more comput- flexible in the selection of neighboring peers and rout- ers, network/IoT devices with the malware to build the ing mechanisms. The unstructured botnets are diffi- botnet [4]. Many robust or stealthy botnets have evolved cult to be crawled and probe, since there is no specific which wrecked havoc on the cyber security. During the structure that can be exploited. onset of botnets the centralized architecture was popular. This architecture is easy to implement and monitor, but Superpeer Overlay Botnets: Select some of the globally suffers from the limitation of easy detection of the central- accessible compromised systems to form the C&C ar- ized servers. Therefore, attackers adopt the decentralized chitecture. The compromised peers behind NAT are or hybrid botnet architectures to overcome the limitations the normal peer bots and connect to any of the su- of the centralized architecture. perpeers to pull published commands. Although the The decentralized P2P or hybrid botnets belong to the design is more scalable, but the superpeers are vul- third generation. In P2P botnets attackers can directly nerable to be detected. Further, the detection and communicate the commands to any peer bot; who further removal of a superpeer does not have any significant communicate the commands to other neighboring peers. impact on the botnet, since communication can be These botnets have many robust features and stay re- redirected to the new super-peers. silient, i.e., even if a significant part of the botnet is taken Hybrid P2P Botnets: Overcame the limitations of cen- down, remaining botnet works under control of bot mas- tralized and decentralized architectures. Many of the ters [6, 34]. P2P botnets are the most prevalent in the real botnets discovered in the wild have multi-layered cyber world since they have many merits in comparison hybrid P2P architecture. This structure employs top to centralized (IRC or HTTP) botnets. layer bots as master C&C servers. The P2P network serves as relay bots at the second layer communicat- ing with the top servers and the bottom client as peer 3 Peer-to-Peer Botnets bots. Many large P2P botnets have been discovered in the wild. This clearly show a tendency towards the decentralized 3.2 Command and Control Mechanisms P2P botnets. These botnets use P2P networks as a vector The command and control (C&C) channels are used to for infestation and the peer nodes as C&C channels [1]. command the bots from remote system. The C&C layer The P2P botnets form complex overlay networks using forms the multi-tier architecture of the botnets and dif- either customized or standard P2P protocols [1]. Figure 1 ferentiate them from other malware. The various C&C shows the timeline of the P2P botnets' evolution. Table 1 architectures are based on different C&C protocols in- lists the characteristics and applications of the well-known cluding IRC, HTTP, P2P, DNS, Bluetooth, email, social P2P botnets developed over a period of time. networks and/or other custom protocols [26, 10]. The bot- nets can select either P2P protocols or non-P2P protocols 3.1 Botnet Architecture for C&C communication. The C&C operations of the botnets are categorized into Botnets are usually characterized on the basis of C&C - pull and push mechanisms. In pull mechanism bot- architecture. The model of a typical botnet can be un- masters publish commands at certain specific locations derstood by the analysis of its architecture, C&C mech- for which the peer bots subscribe and actively receive the anism and its development life-cycle. The various phases commands. The bots execute the commands and also of the botnets are shown in Figure 2. Cooke et al. [8] pre- forward to other peers in their list [24]. In push mech- sented three different botnet communication topologies: anism C&C servers push/forward the commands to peer centralized (IRC-based and HTTP-based), decentralized bots for execution. The peer bots passively wait for the (P2P-based) and random. Grizzard et al. [13] classified commands and also forward the received commands to the architecture of decentralized P2P botnets as: struc- neighboring peer bots. The bots can receive commands tured, unstructured, super-peers and hybrid. to execute using either a push or pull mechanism. The C&C activities can be detected by active moni- Structured P2P Botnets: Use the overlay structured P2P toring of the hosts connecting to the external suspected network and thus employ a globally consistent proto- hosts. Identification of botnet C&C traffic is an important col for efficient routing and search. Storm uses Over- approach to botnet defense, but identification of C&C net structured P2P overlay network protocol to build traffic is difficult since botnets use standard protocols for its C&C infrastructure. Most of the P2P botnets are communications. Moreover, the malicious traffic is simi- based on structured overlays such as Kademlia. The lar to legitimate traffic and is fused with the benign P2P botnets using public protocols let them mix the C&C communication traffic of the legitimate P2P applications traffic with the standards P2P applications. (eg, Skype); Trojan.Peacomm botnet and Stormnet are International Journal of Network Security, Vol.20, No.3, PP.547-557, May 2018 (DOI: 10.6633/IJNS.201805.20(3).18) 549 Table 1: P2P botnets and their characteristics Botnet Name Discovered Architecture a/ Functionalities b Comments Protocols Sinit Sep.
Load more

Recommended publications
  • The Botnet Chronicles a Journey to Infamy
    The Botnet Chronicles A Journey to Infamy Trend Micro, Incorporated Rik Ferguson Senior Security Advisor A Trend Micro White Paper I November 2010 The Botnet Chronicles A Journey to Infamy CONTENTS A Prelude to Evolution ....................................................................................................................4 The Botnet Saga Begins .................................................................................................................5 The Birth of Organized Crime .........................................................................................................7 The Security War Rages On ........................................................................................................... 8 Lost in the White Noise................................................................................................................. 10 Where Do We Go from Here? .......................................................................................................... 11 References ...................................................................................................................................... 12 2 WHITE PAPER I THE BOTNET CHRONICLES: A JOURNEY TO INFAMY The Botnet Chronicles A Journey to Infamy The botnet time line below shows a rundown of the botnets discussed in this white paper. Clicking each botnet’s name in blue will bring you to the page where it is described in more detail. To go back to the time line below from each page, click the ~ at the end of the section. 3 WHITE
    [Show full text]
  • An Introduction to Malware
    Downloaded from orbit.dtu.dk on: Sep 24, 2021 An Introduction to Malware Sharp, Robin Publication date: 2017 Document Version Publisher's PDF, also known as Version of record Link back to DTU Orbit Citation (APA): Sharp, R. (2017). An Introduction to Malware. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. Users may download and print one copy of any publication from the public portal for the purpose of private study or research. You may not further distribute the material or use it for any profit-making activity or commercial gain You may freely distribute the URL identifying the publication in the public portal If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. An Introduction to Malware Robin Sharp DTU Compute Spring 2017 Abstract These notes, written for use in DTU course 02233 on Network Security, give a short introduction to the topic of malware. The most important types of malware are described, together with their basic principles of operation and dissemination, and defenses against malware are discussed. Contents 1 Some Definitions............................2 2 Classification of Malware........................2 3 Vira..................................3 4 Worms................................
    [Show full text]
  • Symantec Intelligence Report: June 2011
    Symantec Intelligence Symantec Intelligence Report: June 2011 Three-quarters of spam send from botnets in June, and three months on, Rustock botnet remains dormant as Cutwail becomes most active; Pharmaceutical spam in decline as new Wiki- pharmacy brand emerges Welcome to the June edition of the Symantec Intelligence report, which for the first time combines the best research and analysis from the Symantec.cloud MessageLabs Intelligence Report and the Symantec State of Spam & Phishing Report. The new integrated report, the Symantec Intelligence Report, provides the latest analysis of cyber security threats, trends and insights from the Symantec Intelligence team concerning malware, spam, and other potentially harmful business risks. The data used to compile the analysis for this combined report includes data from May and June 2011. Report highlights Spam – 72.9% in June (a decrease of 2.9 percentage points since May 2011): page 11 Phishing – One in 330.6 emails identified as phishing (a decrease of 0.05 percentage points since May 2011): page 14 Malware – One in 300.7 emails in June contained malware (a decrease of 0.12 percentage points since May 2011): page 15 Malicious Web sites – 5,415 Web sites blocked per day (an increase of 70.8% since May 2011): page 17 35.1% of all malicious domains blocked were new in June (a decrease of 1.7 percentage points since May 2011): page 17 20.3% of all Web-based malware blocked was new in June (a decrease of 4.3 percentage points since May 2011): page 17 Review of Spam-sending botnets in June 2011: page 3 Clicking to Watch Videos Leads to Pharmacy Spam: page 6 Wiki for Everything, Even for Spam: page 7 Phishers Return for Tax Returns: page 8 Fake Donations Continue to Haunt Japan: page 9 Spam Subject Line Analysis: page 12 Best Practices for Enterprises and Users: page 19 Introduction from the editor Since the shutdown of the Rustock botnet in March1, spam volumes have never quite recovered as the volume of spam in global circulation each day continues to fluctuate, as shown in figure 1, below.
    [Show full text]
  • The Trojan Wars: Building the Big Picture to Combat Efraud
    THE TROJAN WARS: BUILDING THE BIG PICTURE TO COMBAT EFRAUD MNEMONIC THREAT INTELLIGENCE UNIT White Paper TABLE OF CONTENTS INTRODUCTION ................................................................................3 THE INITIAL TORPIG CAMPAIGN ......................................................4 • Infection Cycles ..........................................................................................5 • Ice IX – Downloading Torpig and Pushdo ...................................................6 • Torpig Campaign C&C infrastructure ..........................................................9 • Ice IX Takedown Avoidance Technique .......................................................10 THE FOLLOW-ON P2P ZEUS CAMPAIGN ..........................................11 • Infection Cycles ...........................................................................................12 • Neurevt – Downloading P2P Zeus ..............................................................13 THE WAY FORWARD: CONCLUSIONS AND RECOMMENDATIONS ....14 ABOUT MNEMONIC ..........................................................................15 REFERENCES ...................................................................................16 THE TROJAN WARS - BUILDING THE BIG PICTURE TO COMBAT EFRAUD MNEMONIC AS INTRODUCTION Trojans are a very sophisticated type of malware and their use by cybercriminals to perform widespread eFraud is now well established. They are rarely operated in a standalone mode and the infrastructure used to spread and maintain Trojans is
    [Show full text]
  • Downloading and Running
    City Research Online City, University of London Institutional Repository Citation: Meng, X. (2018). An integrated networkbased mobile botnet detection system. (Unpublished Doctoral thesis, City, Universtiy of London) This is the accepted version of the paper. This version of the publication may differ from the final published version. Permanent repository link: https://openaccess.city.ac.uk/id/eprint/19840/ Link to published version: Copyright: City Research Online aims to make research outputs of City, University of London available to a wider audience. Copyright and Moral Rights remain with the author(s) and/or copyright holders. URLs from City Research Online may be freely distributed and linked to. Reuse: Copies of full items can be used for personal research or study, educational, or not-for-profit purposes without prior permission or charge. Provided that the authors, title and full bibliographic details are credited, a hyperlink and/or URL is given for the original metadata page and the content is not changed in any way. City Research Online: http://openaccess.city.ac.uk/ [email protected] AN INTEGRATED NETWORK- BASED MOBILE BOTNET DETECTION SYSTEM Xin Meng Department of Computer Science City, University of London This dissertation is submitted for the degree of Doctor of Philosophy City University London June 2017 Declaration I hereby declare that except where specific reference is made to the work of others, the contents of this dissertation are original and have not been submitted in whole or in part for consideration for any other degree or qualification in this, or any other University. This dissertation is the result of my own work and includes nothing which is the outcome of work done in collaboration, except where specifically indicated in the text.
    [Show full text]
  • FORECAST – Skimming Off the Malware Cream
    FORECAST – Skimming off the Malware Cream Matthias Neugschwandtner1, Paolo Milani Comparetti1, Gregoire Jacob2, and Christopher Kruegel2 1Vienna University of Technology, {mneug,pmilani}@seclab.tuwien.ac.at 2University of California, Santa Barbara, {gregoire,chris}@cs.ucsb.edu ABSTRACT Malware commonly employs various forms of packing and ob- To handle the large number of malware samples appearing in the fuscation to resist static analysis. Therefore, the most widespread wild each day, security analysts and vendors employ automated approach to the analysis of malware samples is currently based on tools to detect, classify and analyze malicious code. Because mal- executing the malicious code in a controlled environment to ob- ware is typically resistant to static analysis, automated dynamic serve its behavior. Dynamic analysis tools such as CWSandbox [3], analysis is widely used for this purpose. Executing malicious soft- Norman Sandbox and Anubis [13, 2] execute a malware sample in ware in a controlled environment while observing its behavior can an instrumented sandbox and record its interactions with system provide rich information on a malware’s capabilities. However, and network resources. This information can be distilled into a running each malware sample even for a few minutes is expensive. human-readable report that provides an analyst with a high level For this reason, malware analysis efforts need to select a subset of view of a sample’s behavior, but it can also be fed as input to fur- samples for analysis. To date, this selection has been performed ei- ther automatic analysis tasks. Execution logs and network traces ther randomly or using techniques focused on avoiding re-analysis provided by dynamic analysis have been used to classify malware of polymorphic malware variants [41, 23].
    [Show full text]
  • YOUR BABY MONITOR IS ATTACKING the GOVERNMENT a Perspective on Security Risks Today and a Look Towards the Future
    YOUR BABY MONITOR IS ATTACKING THE GOVERNMENT A perspective on security risks today and a look towards the future Nick McKerrall | Threat Prevention Team ©2016 Check Point Software Technologies Ltd. 1 2016 Statistics 5.5 million “things” are getting connected 75% of the to the internet every organizations we day perform security checkups on have machines infected Every 32 minutes – Sensitive with bots data is sent outside the org Every 5 seconds – a host Every 4 minutes - a high accesses a malicious risk application is used website ©2016 Check Point Software Technologies Ltd. September 2016 World Cyber Threat Map Green – Low Risk Beige – Medium Pink – Higher Red – Highest White – Insufficient Data RED: Bolivia, Angola, Zambia, Botswana, Uganda, Mongolia, Sri Lanka, Vietnam ©2016 Check Point Software Technologies Ltd. 3 September 2016 ‘Most Wanted’ Malware 1. Conficker Worm – Botnet 2. Sality – Remote Access and Control 3. Locky – Ransomware (via mostly email) 4. Cutwail – Botnet (Spam/DDoS) 5. Zeus – Banking Trojan 6. Chanitor – Downloader 7. Tinba – Banking Trojan 8. Cryptowall – Ransomware (via exploit kits and phishing) 9. Blackhole – Exploit kit 10. Nivdort (Bayrob) – Multipurpose bot September 2016 ‘Mobile Most Wanted’ Malware 1. HummingBad – Android Rootkit 2. Triada – Android Backdoor 3. Ztorg - Application Dropper ©2016 Check Point Software Technologies Ltd. 4 The threat landscape is changing You need to dynamically adjust to new threat sources Attacks change geography all the time Malware is changing constantly Both in signature/variant and purpose We are seeing new levels of sophistication Malware is becoming big business Our approach to protecting networks needs to change ©2016 Check Point Software Technologies Ltd.
    [Show full text]
  • SHS Branding LAUNCH
    MESSAGELABS INTELLIGENCE MESSAGELABS INTELLIGENCE FEBRUARY 2010 Spam Surges in February while Message Size Shrinks Welcome to the February edition of the MessageLabs Intelligence monthly report. This report provides the latest threat trends for February 2010 to keep you informed regarding the ongoing fight against viruses, spam and other unwelcome content. REPORT HIGHLIGHTS Spam – 89.4% in February (an increase of 5.5% since January) Viruses – One in 302.8 emails in February contained malware (an increase of 0.02% since January) Phishing – One in 456.3 emails comprised a phishing attack (an increase of 0.04% since January) Malicious websites – 4,998 websites blocked per day (an increase of 184% since January) 41.6% of all malicious domains blocked were new in February (a decrease of 0.1% since January) 13.3 of all web-based malware blocked was new in February (an increase of 1.2% since January) Grum and Rustock to Blame for February Spam Surge While Volume Grows, Spam File Size Shrinks Waledac Botnet Makes a Comeback before its Demise Olympics-Themed Targeted Malware Gumblar Update REPORT ANALYSIS Grum and Rustock to Blame for Surge in February Spam As expected this time of year, spammers launched a number of spam campaigns related to St. Valentine‟s Day, celebrated on February 14. Around this time, spammers often change their spam runs to include references to the special date. However, the 5.5% increase in spam this month cannot be completely blamed on St. Valentine‟s Day alone. Figure 1 highlights the most recent spam surges in February, and further analysis reveals the underlying cause of these increases.
    [Show full text]
  • The Underground Economy of Spam: a Botmaster’S Perspective of Coordinating Large-Scale Spam Campaigns
    The Underground Economy of Spam: A Botmaster’s Perspective of Coordinating Large-Scale Spam Campaigns Brett Stone-Grossx;?, Thorsten Holzz;?, Gianluca Stringhinix, and Giovanni Vignax;? xUniversity of California, Santa Barbara z Ruhr-University Bochum fbstone,gianluca,[email protected] [email protected] ? LastLine, Inc., Santa Barbara CA 93111, USA fbrett,tho,[email protected] Abstract under their control. According to a recent study by Spam accounts for a large portion of the email exchange Symantec, more than 89% of all email messages on the on the Internet. In addition to being a nuisance and Internet were attributed to spam in the year 2010. Fur- a waste of costly resources, spam is used as a deliv- thermore, about 88% of these spam messages were sent ery mechanism for many criminal scams and large-scale with the help of botnets [12]. This huge percentage of compromises. Most of this spam is sent using botnets, botnet-related spam is due to several advantages that a which are often rented for a fee to criminal organizations. botnet can provide with respect to other kinds of spam Even though there has been a considerable corpus of re- delivery mechanisms. First, since a botnet operates as a search focused on combating spam and analyzing spam- distributed system where each infected machine receives related botnets, most of these efforts have had a limited a subset of the overall tasks, the amount of resources re- view of the entire spamming process. quired by the spam operator is greatly reduced. This in- In this paper, we present a comprehensive analysis of a creases the effective throughput, as the bots perform the large-scale botnet from the botmaster’s perspective, that majority of the work on their own.
    [Show full text]
  • SHS Branding LAUNCH
    MESSAGELABS INTELLIGENCE MESSAGELABS INTELLIGENCE MARCH 2010 The Nature of Cyber Espionage; Most Malicious File Types Identified and Encrypted Spam from Rustock Welcome to the March edition of the MessageLabs Intelligence monthly report. This report provides the latest threat trends for March 2010 to keep you informed regarding the ongoing fight against viruses, spam and other unwelcome content. REPORT HIGHLIGHTS Spam – 90.7% in March (an increase of 1.4 percentage points since February) Viruses – One in 358.3 emails in March contained malware (a decrease of 0.05 percentage points since February) Phishing – One in 513.7 emails comprised a phishing attack (a decrease of 0.02 percentage points since February) Malicious websites – 1,919 websites blocked per day (a decrease of 61.6% since February) 39.9% of all malicious domains blocked were new in March (a decrease of 4.8 percentage points since February) 14.9% of all web-based malware blocked was new in March (an increase of 1.6 percentage points since February) The nature of industrial espionage and targeted attacks Understanding the most frequently targeted job roles in targeted attacks Death by a thousand cuts: Rustock botnet sends more encrypted spam REPORT ANALYSIS The nature of industrial espionage and targeted attacks The ultimate aim of a targeted attack is to gain access to sensitive data or internal systems by targeting specific individuals or companies. They are sent in relatively small volumes compared with spam and phishing emails, for example, but are one of the most damaging email threats. Any organization that possesses sensitive and valuable data can be an attractive target.
    [Show full text]
  • Characterization and Modeling of Top Spam Botnets
    Network Protocols and Algorithms ISSN 1943-3581 2012, Vol. 4, No. 4 Characterization and Modeling of Top Spam Botnets Nuno Rodrigues Polytechnical Institute of Bragança/Instituto de Telecomunicações Campus Universitário de Santiago, 3810-193 Aveiro, Portugal Tel: 351-234-377-900 E-mail: [email protected] Rui Sousa University of Aveiro, DETI/Instituto de Telecomunicações Campus Universitário de Santiago, 3810-193 Aveiro, Portugal Tel: 351-234-377-900 E-mail: [email protected] Paulo Salvador University of Aveiro, DETI/Instituto de Telecomunicações Campus Universitário de Santiago, 3810-193 Aveiro, Portugal Tel: 351-234-377-900 E-mail: [email protected] António Nogueira University of Aveiro, DETI/Instituto de Telecomunicações Campus Universitário de Santiago, 3810-193 Aveiro, Portugal Tel: 351-234-377-900 E-mail: [email protected] Received: July 6, 2012 Accepted: November 17, 2012 Published: December 16, 2012 DOI: 10.5296/npa.v4i4.2058 URL: http://dx.doi.org/10.5296/ npa.v4i4.2058 1 www.macrothink.org/npa Network Protocols and Algorithms ISSN 1943-3581 2012, Vol. 4, No. 4 Abstract The increasing impact of the Internet in the global economy has transformed Botnets into one of the most relevant security threats for citizens, organizations and governments. Despite the significant efforts that have been made over the last years to understand this phenomenon and develop detection techniques and countermeasures, this continues to be a field with big challenges to address. Several approaches can be taken to study Botnets: analyze its source code, which can be a hard task because it is usually unavailable; study the control mechanism, particularly the activity of its Command and Control server(s); study its behavior, by measuring real traffic and collecting relevant statistics.
    [Show full text]
  • Cyberpro October 22, 2009
    Volume 2, Edition 21 CyberPro October 22, 2009 Keeping Cyberspace Professionals Informed Officers The articles and information appearing herein are intended for President educational purposes to promote discussion in the public interest and to Larry K. McKee, Jr. keep subscribers who are involved in the development of Cyber-related concepts and initiatives informed on items of common interest. The Chief Operations Officer newsletter and the information contained therein are not intended to Jim Ed Crouch provide a competitive advantage for any commercial firm. Any misuse or unauthorized use of the newsletter and its contents will result in removal ------------------------------ from the distribution list and/or possible administrative, civil, and/or CyberPro Editor-in-Chief criminal action. Lindsay Trimble The views, opinions, and/or findings and recommendations contained in CyberPro Research Analyst this summary are those of the authors and should not be construed as an Kathryn Stephens official position, policy, or decision of the United States Government, U.S. Department of Defense, or National Security Cyberspace Institute. CyberPro Archive To subscribe or unsubscribe to this newsletter click here CyberPro News Subscription. Please contact Lindsay Trimble regarding CyberPro subscription, sponsorship, and/or advertisement. All rights reserved. CyberPro may not be published, broadcast, rewritten or redistributed without prior NSCI consent. 110 Royal Aberdeen Smithfield, VA 23430 ph. (757) 871 - 3578 CyberPro National Security Cyberspace Institute P a g e | 1 Volume 2, Edition 21 CyberPro October 22, 2009 Keeping Cyberspace Professionals Informed TABLE OF CONTENTS This Week in CyberPro ........................................................................................................... 5 Cyber Jihad – Use of the virtual world .................................................................................... 6 Panel: How business can beat hackers at their own game ...................................................
    [Show full text]