Advanced Methods for Botnet Intrusion Detection Systems

Intrusion Detection Systems 56 techniques developed by researchers; and also focus on a mobile agent based technique to detect infected hosts. Botnet offenseIn order to better understand the challenges that the security community faces in order to dismantle botnets, we first need to understand how botnets function, and the many tools and techniques employed by them. Setting up a command and control serverThe first step in creating a botnet is to setup the Command and Control (C&C) server.This is the location where the infected hosts report to the botmaster, letting it know that a host has been infected successfully.This is also the location where the infected hosts retrieve the full list of commands that the infected bot should run.Section 2.3 covers some of the communication features of a C&C server. Bot lifecycleUnlike the initial advanced botnets such as Agobot which carried a list of exploits to perform on a vulnerable host and its entire command set at the time of initial infection, every advanced bot today uses multiple stages in order to form a botnet (Schiller et al., 2007;Gu et al., 2007).This was mainly done first, to avoid signature detection by network intrusion detection systems such as snort (Roesch, 1999) and second, to reduce the initial infection size of the bot binary to make it less traceable while using drive-by-download attacks.Stage 1 of a bot's lifecycle is the initial infection/exploit of a host.In this step the bot binary has to first infect the host by attempting to exploit one or more security vulnerabilities that might pre-exist on a system.Section 2.4 provides further details on the associated techniques that botmasters could use in this step.Once infected, stage 2 is the process by which the bot reports back to the botmaster using the command and control (C&C) channel to inform him that the host has been successfully compromised.Information related to the host such as opened backdoors, host operation system settings and network capabilities are just some of the details that are reported back during this phase.In stage 3 the bot downloads new executables.This process is also referred to as egg downloading.This could be the component that detects and disables antivirus software, or could provide potential updates to the bot malware with its full command list to make it more functional.In stage 4 the downloaded malware is executed on the bot.The bot at this stage has become fully functional.In stage 5, the bot starts listening to the command-and-control channel to retrieve payload information from peers or servers and could execute the commands that are passed on using the payload.It is not necessary that the channel used in stage 3 is the same channel used in stage 5.In stage 6, the bot could optionally report the results of executing the commands to the server.This feature is used by many botnets to track the functionality of the bot so that the botnet could be load-balanced. Botnet communication structureThe most important component of a botnet that decides if it can be easily dismantled is its communication structure which is used to command and control the infected hosts of a botnet.The type of communication used between a bot client and its command-and-control www.intechopen.com

Récupéré en direct depuis OpenAlex et désinversé. Les résumés ne sont pas conservés dans cette base de données : les index inversés représentent 8,6 Go des 9,3 Go de texte de la base, et le serveur dispose de 13 Go libres.