Abstract
Botnets, which consist of thousands of compromised machines, can cause significant threats to other systems by launching Distributed Denial of Service (DDoS) attacks, keylogging, and backdoors. In response to these threats, new effective techniques are needed to detect the presence of botnets. In this paper, we have used an interception technique to monitor Windows Application Programming Interface (API) functions calls made by communication applications and store these calls with their arguments in log files. Our algorithm detects botnets based on monitoring abnormal activity by correlating the changes in log file sizes from different hosts.
Highlights
An explosive growth of coordinated attacks has been noticed [1][6]
We focus on detecting botnets that use a centralized network
We investigate the normal behaviour of an mIRC clients vs. the sdbot
Summary
An explosive growth of coordinated attacks has been noticed [1][6]. This kind of attack is performed by using Internet Relay Chat (IRC) networks to control compromised machines (zombies) and establish a distributed attack against other systems. A collection of compromised machines that are connected to a single channel on IRC networks forms a (Botnet) These machines can be controlled remotely by the attacker via command and control (C&C) to perform malicious activities such as DDoS attack. Most current bots are implemented to use a centralized network, which allow them to receive instructions from a central point This makes the process of tracing the bot herder (i.e. the attacker) a relatively easy task. The outgoing connections have different lengths and the number of bytes transferred per connection is not fixed [2] To address these problems, our aim is to detect botnets by monitoring the change of behaviour in log file sizes across several hosts and find the correlation between these changes.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.