Botnet Detection and Analysis Using Honeynet

Abstract

We discuss some techniques currently used by intruders to control groups of compromised machines (botnets). We show how honeynets can be used to identify, monitor and understand the behavior of botnets. We describe a real attack in detail, illustrating analysis techniques developed specifically for botnets. The tools, network topology and strategies we describe can easily be adopted by other researchers and the network security community.