Survey and Research Challenges of Botnet Forensics
---
paper_title: An Analysis of the Asprox Botnet

paper_content:

The presence of large pools of compromised computers, also known as botnets, or zombie armies, represents a very serious threat to Internet security. This paper describes the architecture of a contemporary advanced bot commonly known as Asprox. Asprox is a type of malware that combines the two threat vectors of forming a botnet and of generating SQL injection attacks. The main features of the Asprox botnet are the use of centralized command and control structure, HTTP based communication, use of advanced double fast-flux service networks, use of SQL injection attacks for recruiting new bots and social engineering tricks to spread malware binaries. The objective of this paper is to contribute to a deeper understanding of Asprox in particular and a better understanding of modern botnet designs in general. This knowledge can be used to develop more effective methods for detecting botnets, and stopping the spreading of botnets on the Internet.
---
paper_title: Detection of botnets using combined host- and network-level information

paper_content:

Bots are coordinated by a command and control (C&C) infrastructure to launch attacks that seriously threaten the Internet services and users. Most botnet-detection approaches function at the network level and require the analysis of packets' payloads, raising privacy concerns and incurring large computational overheads. Moreover, network traffic analysis alone can seldom provide a complete picture of botnets' behavior. By contrast, in-host detection approaches are useful to identify each bot's host-wide behavior, but are susceptible to the host-resident malware if used alone. To address these limitations, we consider both the coordination within a botnet and the malicious behavior each bot exhibits at the host level, and propose a C&C protocol-independent detection framework that combines host- and network-level information for making detection decisions. The framework is shown to be effective in detecting various types of botnets with low false-alarm rates.
---
paper_title: A survey on automated dynamic malware-analysis techniques and tools

paper_content:

Anti-virus vendors are confronted with a multitude of potentially malicious samples today. Receiving thousands of new samples every day is not uncommon. The signatures that detect confirmed malicious threats are mainly still created manually, so it is important to discriminate between samples that pose a new unknown threat and those that are mere variants of known malware. This survey article provides an overview of techniques based on dynamic analysis that are used to analyze potentially malicious samples. It also covers analysis programs that leverage these It also covers analysis programs that employ these techniques to assist human analysts in assessing, in a timely and appropriate manner, whether a given sample deserves closer manual inspection due to its unknown malicious behavior.
---
paper_title: Your botnet is my botnet: analysis of a botnet takeover

paper_content:

Botnets, networks of malware-infected machines that are controlled by an adversary, are the root cause of a large number of security problems on the Internet. A particularly sophisticated and insidious type of bot is Torpig, a malware program that is designed to harvest sensitive information (such as bank account and credit card data) from its victims. In this paper, we report on our efforts to take control of the Torpig botnet and study its operations for a period of ten days. During this time, we observed more than 180 thousand infections and recorded almost 70 GB of data that the bots collected. While botnets have been "hijacked" and studied previously, the Torpig botnet exhibits certain properties that make the analysis of the data particularly interesting. First, it is possible (with reasonable accuracy) to identify unique bot infections and relate that number to the more than 1.2 million IP addresses that contacted our command and control server. Second, the Torpig botnet is large, targets a variety of applications, and gathers a rich and diverse set of data from the infected victims. This data provides a new understanding of the type and amount of personal information that is stolen by botnets.
---
paper_title: BotCop: An Online Botnet Traffic Classifier

paper_content:

A botnet is a network of compromised computers infected with malicious code that can be controlled remotely under a common command and control (C&C) channel. As one the most serious security threats to the Internet, a botnet cannot only be implemented with existing network applications (e.g. IRC, HTTP, or Peer-to-Peer) but also can be constructed by unknown or creative applications, thus making the botnet detection a challenging problem. In this paper, we propose a new online botnet traffic classification system, called BotCop, in which the network traffic are fully classified into different application communities by using payload signatures and a novel decision tree model, and then on each obtained application community, the temporal-frequent characteristic of flows is studied and analyzed to differentiate the malicious communication traffic created by bots from normal traffic generated by human beings. We evaluate our approach with about 30 million flows collected over one day on a large-scale WiFi ISP network and results show that the proposed approach successfully detects an IRC botnet from about 30 million flows with a high detection rate and a low false alarm rate.
---
paper_title: Network forensic frameworks: Survey and research challenges

paper_content:

Network forensics is the science that deals with capture, recording, and analysis of network traffic for detecting intrusions and investigating them. This paper makes an exhaustive survey of various network forensic frameworks proposed till date. A generic process model for network forensics is proposed which is built on various existing models of digital forensics. Definition, categorization and motivation for network forensics are clearly stated. The functionality of various Network Forensic Analysis Tools (NFATs) and network security monitoring tools, available for forensics examiners is discussed. The specific research gaps existing in implementation frameworks, process models and analysis tools are identified and major challenges are highlighted. The significance of this work is that it presents an overview on network forensics covering tools, process models and framework implementations, which will be very much useful for security practitioners and researchers in exploring this upcoming and young discipline.
---
paper_title: Botnets: A survey

paper_content:

Botnets, which are networks formed by malware-compromised machines, have become a serious threat to the Internet. Such networks have been created to conduct large-scale illegal activities, even jeopardizing the operation of private and public services in several countries around the world. Although research on the topic of botnets is relatively new, it has been the subject of increasing interest in recent years and has spawned a growing number of publications. However, existing studies remain somewhat limited in scope and do not generally include recent research and developments. This paper presents a comprehensive review that broadly discusses the botnet problem, briefly summarizes the previously published studies and supplements these with a wide ranging discussion of recent works and solution proposals spanning the entire botnet research field. This paper also presents and discusses a list of the prominent and persistent research problems that remain open.
---
paper_title: A Survey of Botnet Technology and Defenses

paper_content:

Global Internet threats have undergone a profound transformation from attacks designed solely to disable infrastructure to those that also target people and organizations. At the center of many of these attacks are collections of compromised computers, or Botnets, remotely controlled by the attackers, and whose members are located in homes, schools, businesses, and governments around the world [6]. In this survey paper we provide a brief look at how existing botnet research, the evolution and future of botnets, as well as the goals and visibility of today’s networks intersect to inform the field of botnet technology and defense.
---
paper_title: Analysis of HTTP2P botnet: case study waledac

paper_content:

Malicious botnet is evolving very quickly and using the many ways to evade detection system. The change of protocol is the most important part of the malicious botnet's evolution and evasion techniques. The initial malicious botnet was using the IRC protocol for communication between the command and contorl server and the zombie system. After that they use the HTTP protocol on the firewall-friendly and the P2P protocol to escape a Client/Server architecture. Because Many researchers studied malicious HTTP or P2P botnet for detection, the malicious botnet began to use the distorted communication method called HTTP2P. In this paper, we study the malicious HTTP2P botnet, and we will give to help malicious HTTP2P botnet detection by analyzing waledac botnet.
---
paper_title: Analysis of HTTP2P botnet: case study waledac

paper_content:

Malicious botnet is evolving very quickly and using the many ways to evade detection system. The change of protocol is the most important part of the malicious botnet's evolution and evasion techniques. The initial malicious botnet was using the IRC protocol for communication between the command and contorl server and the zombie system. After that they use the HTTP protocol on the firewall-friendly and the P2P protocol to escape a Client/Server architecture. Because Many researchers studied malicious HTTP or P2P botnet for detection, the malicious botnet began to use the distorted communication method called HTTP2P. In this paper, we study the malicious HTTP2P botnet, and we will give to help malicious HTTP2P botnet detection by analyzing waledac botnet.
---
paper_title: A Survey of Botnet Technology and Defenses

paper_content:

Global Internet threats have undergone a profound transformation from attacks designed solely to disable infrastructure to those that also target people and organizations. At the center of many of these attacks are collections of compromised computers, or Botnets, remotely controlled by the attackers, and whose members are located in homes, schools, businesses, and governments around the world [6]. In this survey paper we provide a brief look at how existing botnet research, the evolution and future of botnets, as well as the goals and visibility of today’s networks intersect to inform the field of botnet technology and defense.
---
paper_title: Detecting P2P botnets through network behavior analysis and machine learning

paper_content:

Botnets have become one of the major threats on the Internet for serving as a vector for carrying attacks against organizations and committing cybercrimes. They are used to generate spam, carry out DDOS attacks and click-fraud, and steal sensitive information. In this paper, we propose a new approach for characterizing and detecting botnets using network traffic behaviors. Our approach focuses on detecting the bots before they launch their attack. We focus in this paper on detecting P2P bots, which represent the newest and most challenging types of botnets currently available. We study the ability of five different commonly used machine learning techniques to meet online botnet detection requirements, namely adaptability, novelty detection, and early detection. The results of our experimental evaluation based on existing datasets show that it is possible to detect effectively botnets during the botnet Command-and- Control (C&C) phase and before they launch their attacks using traffic behaviors only. However, none of the studied techniques can address all the above requirements at once.
---
paper_title: An Advanced Hybrid Peer-to-Peer Botnet

paper_content:

A "botnet" consists of a network of compromised computers controlled by an attacker ("botmaster"). Recently botnets have become the root cause of many Internet attacks. To be well prepared for future attacks, it is not enough to study how to detect and defend against the botnets that have appeared in the past. More importantly, we should study advanced botnet designs that could be developed by botmasters in the near future. In this paper, we present the design of an advanced hybrid peer-to-peer botnet. Compared with current botnets, the proposed botnet is harder to be shut down, monitored, and hijacked. It provides robust network connectivity, individualized encryption and control traffic dispersion, limited botnet exposure by each bot, and easy monitoring and recovery by its botmaster. Possible defenses against this advanced botnet are suggested.
---
paper_title: Deep Analysis of Intending Peer-to-Peer Botnet

paper_content:

Botnet has recently been identified as one of the most important security threats of the Internet. So we should study the new technology which may be used by botmaster in the near future. In this paper we predict the new feature of the next generation botnet and present the design of an advanced P2P botnet basing on our discussion.
---
paper_title: Cross-Analysis of Botnet Victims: New Insights and Implications

paper_content:

In this paper, we analyze a large amount of infection data for three major botnets: Conficker, MegaD, and Srizbi. These botnets represent two distinct types of botnets in terms of the methods they use to recruit new victims. We propose the use of cross-analysis between these different types of botnets as well as between botnets of the same type in order to gain insights into the nature of their infection. In this analysis, we examine commonly-infected networks which appear to be extremely prone to malware infection. We provide an in-depth passive and active measurement study to have a fine-grained view of the similarities and differences for the two infection types. Based on our cross-analysis results, we further derive new implications and insights for defense. For example, we empirically show the promising power of cross-prediction of new unknown botnet victim networks using historic infection data of some known botnet that uses the same infection type with more than 80% accuracy.
---
paper_title: On the analysis of the Zeus botnet crimeware toolkit

paper_content:

In this paper, we present our reverse engineering results for the Zeus crimeware toolkit which is one of the recent and powerful crimeware tools that emerged in the Internet underground community to control botnets. Zeus has reportedly infected over 3.6 million computers in the United States. Our analysis aims at uncovering the various obfuscation levels and shedding the light on the resulting code. Accordingly, we explain the bot building and installation/infection processes. In addition, we detail a method to extract the encryption key from the malware binary and use that to decrypt the network communications and the botnet configuration information. The reverse engineering insights, together with network traffic analysis, allow for a better understanding of the technologies and behaviors of such modern HTTP botnet crimeware toolkits and opens an opportunity to inject falsified information into the botnet communications which can be used to defame this crimeware toolkit.
---
paper_title: A Host-Based Approach to BotNet Investigation?

paper_content:

Robot Networks (BotNets) are one of the most serious threats faced by the online community today. Since their appearance in the late 1990’s, much effort has been expended in trying to thwart their unprecedented growth. However, with robust and advanced capabilities, it is very difficult for average users to avoid or prevent infection by BotNet malware. Moreover, whilst BotNets have increased in scale, scope and sophistication, the dearth of standardized and effective investigative procedures poses huge challenges to digital investigators in trying to probe such cases. In this paper we present a practical (and repeatable) host-based investigative methodology to the collection of evidentiary information from a Bot-infected machine. Our approach collects digital traces from both the network and physical memory of the infected local host, and correlates this information to identify the resident BotNet malware involved.
---
paper_title: Analysis of HTTP2P botnet: case study waledac

paper_content:

Malicious botnet is evolving very quickly and using the many ways to evade detection system. The change of protocol is the most important part of the malicious botnet's evolution and evasion techniques. The initial malicious botnet was using the IRC protocol for communication between the command and contorl server and the zombie system. After that they use the HTTP protocol on the firewall-friendly and the P2P protocol to escape a Client/Server architecture. Because Many researchers studied malicious HTTP or P2P botnet for detection, the malicious botnet began to use the distorted communication method called HTTP2P. In this paper, we study the malicious HTTP2P botnet, and we will give to help malicious HTTP2P botnet detection by analyzing waledac botnet.
---
paper_title: Your botnet is my botnet: analysis of a botnet takeover

paper_content:

Botnets, networks of malware-infected machines that are controlled by an adversary, are the root cause of a large number of security problems on the Internet. A particularly sophisticated and insidious type of bot is Torpig, a malware program that is designed to harvest sensitive information (such as bank account and credit card data) from its victims. In this paper, we report on our efforts to take control of the Torpig botnet and study its operations for a period of ten days. During this time, we observed more than 180 thousand infections and recorded almost 70 GB of data that the bots collected. While botnets have been "hijacked" and studied previously, the Torpig botnet exhibits certain properties that make the analysis of the data particularly interesting. First, it is possible (with reasonable accuracy) to identify unique bot infections and relate that number to the more than 1.2 million IP addresses that contacted our command and control server. Second, the Torpig botnet is large, targets a variety of applications, and gathers a rich and diverse set of data from the infected victims. This data provides a new understanding of the type and amount of personal information that is stolen by botnets.
---
paper_title: BotCop: An Online Botnet Traffic Classifier

paper_content:

A botnet is a network of compromised computers infected with malicious code that can be controlled remotely under a common command and control (C&C) channel. As one the most serious security threats to the Internet, a botnet cannot only be implemented with existing network applications (e.g. IRC, HTTP, or Peer-to-Peer) but also can be constructed by unknown or creative applications, thus making the botnet detection a challenging problem. In this paper, we propose a new online botnet traffic classification system, called BotCop, in which the network traffic are fully classified into different application communities by using payload signatures and a novel decision tree model, and then on each obtained application community, the temporal-frequent characteristic of flows is studied and analyzed to differentiate the malicious communication traffic created by bots from normal traffic generated by human beings. We evaluate our approach with about 30 million flows collected over one day on a large-scale WiFi ISP network and results show that the proposed approach successfully detects an IRC botnet from about 30 million flows with a high detection rate and a low false alarm rate.
---
paper_title: Identifying Malware Using Cross-Evidence Correlation

paper_content:

This paper proposes a new correlation method for the automatic identification of malware traces across multiple computers. The method supports forensic investigations by efficiently identifying patterns in large, complex datasets using link mining techniques. Digital forensic processes are followed to ensure evidence integrity and chain of custody.
---
paper_title: A framework for financial botnet analysis

paper_content:

Financial botnets, those specifically aimed at carrying out financial fraud, represent a well-known threat for banking institutions all around the globe. Unfortunately, these malicious networks are responsible for huge economic losses or for conducting money laundering operations. Contrary to DDoS and spam malware, the stealthy nature of financial botnets requires new techniques and novel research in order to detect, analyze and even to take them down.
---
paper_title: Propagation Model for Botnet Based on Conficker Monitoring

paper_content:

Conficker is a worm outbreak recently which form a large botnet and became a huge threat to the security of the internet. In this paper, the redirect technology of domain name was used to monitor the conficker. For it’s low killing rate and long-term period of propagation, we built a propagation model of botnet based on conficker monitoring. In the model, we take into account the geography, connectivity and other factors cause difference in propagation capacity of computer, and finally verified the validity of the model with the real monitoring data.
---
paper_title: Modeling computer virus prevalence with a susceptible-infected-susceptible model with reintroduction

paper_content:

Abstract Computer viruses are an extremely important aspect of computer security, and understanding their spread and extent is an important component of any defensive strategy. Epidemiological models have been proposed to deal with this issue, and we present one such here. We consider a modification of the Susceptible–Infected–Susceptible (SIS) epidemiological model as a model of computer virus spread. This model includes a reintroduction parameter, which models the rerelease of a computer virus, or the introduction of a new virus. This is a more realistic model of computer virus spread than the standard SIS model, and can be used to understand the behavior of the quasi-stationary regime of the SIS model.
---
paper_title: Botnet Tracking : Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks

paper_content:

Denial-of-Service (DoS) attacks pose a significant threat to the Internet today especially if they are distributed, i.e., launched simultaneously at a large number of systems. Reactive techniques that try to detect such an attack and throttle down malicious traffic prevail today but usually require an additional infrastructure to be really effective. In this paper we show that preventive mechanisms can be as effective with much less effort: We present an approach to (distributed) DoS attack prevention that is based on the observation that coordinated automated activity by many hosts needs a mechanism to remotely control them. To prevent such attacks, it is therefore possible to identify, infiltrate and analyze this remote control mechanism and to stop it in an automated fashion. We show that this method can be realized in the Internet by describing how we infiltrated and tracked IRC-based botnets which are the main DoS technology used by attackers today.
---

<format>
Title: Survey and Research Challenges of Botnet Forensics

Section 1: INTRODUCTION
Description 1: Provide a comprehensive introduction to botnets, their structure, and their impact on cybersecurity. Discuss the methods of botnet detection, analysis techniques, and the importance of botnet forensics.

Section 2: BACKGROUND AND MOTIVATION
Description 2: Discuss the basic elements of botnets, the botnet life cycle, and the motivation behind the creation and maintenance of botnets. Explain the phases involved in the botnet life cycle.

Section 3: Proliferation and Motivation
Description 3: Explain how botnets proliferate and the motivations behind their use. Discuss the various propagation vectors and methods attackers use to expand botnets.

Section 4: C& C (Command And Control)
Description 4: Describe different command and control (C&C) communication structures used in botnets, including centralized, peer-to-peer, and hybrid models. Explain the strengths and weaknesses of each model.

Section 5: Attacks and Theft
Description 5: Detail the types of attacks and thefts perpetrated by botnets, including denial of service (DoS) attacks and data theft. Discuss how attackers extract value from compromised machines.

Section 6: STATE -OF -ART
Description 6: Provide an overview of current research and methodologies in botnet behavior analysis, detection, and mitigation. Discuss various state-of-the-art techniques and tools used by researchers and cybersecurity professionals.

Section 7: MODEL OF BOTNET FORENSIC
Description 7: Introduce various models used in botnet forensic analysis, such as the WT-SIR model, ADSIR model, Diurnal (Botnet Propagation Using Time Zones) Model, and SIS model. Explain how these models help in understanding botnet propagation and formulating defense strategies.

Section 8: BOTNET DEFENSE TECHNIQUES
Description 8: Discuss different techniques and strategies employed to defend against botnets, including prevention, detection, treatment, and containment measures. Mention the role of software, honeypots, and DNS server configuration in botnet defense.

Section 9: RESEARCH CHALLENGES
Description 9: Identify the main research challenges in botnet forensics, including collection and detection, estimating botnet size, analysis, investigation, temporal correlation techniques, cryptography, reverse engineering, and complexity in binary analysis.

Section 10: CONCLUSION AND FUTURE WORK
Description 10: Summarize the main points discussed in the paper, highlighting the ongoing issues and challenges. Propose future research directions to improve botnet detection, defense mechanisms, and the overall understanding of botnet forensics.
</format>
