Botnet detection techniques – An analysis

Abstract

A botnet is a network of computers that has been compromised under the influence of malware code and being controlled by botmaster remotely. Every single day botnets develop new evasion techniques to make their presence undetectable. Knowing the consequences of botnets attacks; security analyzer must develop more robust detection methods. In this paper, an overview of botnets along with some real example of the same i.e. rustock, waledac, zeus, conficker are given. Signature based detection technique focuses on pattern, such as network traffic and then search for the known malicious pattern only. Therefore, to detect unknown attacks a robust detection technique is required. Anomaly-based detection techniques are used in such cases. Analysis of anomaly-based detection techniques are probed in this paper.