The Zombie roundup: understanding, detecting, and disrupting botnets

TLDR

Internet threats are shifting from infrastructure attacks to those targeting people and organizations, driven by widespread botnet‑controlled compromised hosts that form rapidly evolving zombie armies. This paper aims to map the origins and structure of bots and botnets, illustrate the current problem using operator community data, the Internet Motion Sensor project, and a honeypot experiment, and evaluate the effectiveness of detection methods. The authors analyze data from the operator community, IMS, and honeypot experiments, monitor IRC and other command‑and‑control traffic, and propose a detection system that correlates secondary data from multiple sources to identify botnets with advanced C&C.

Abstract

Global Internet threats are undergoing a profound transformation from attacks designed solely to disable infrastructure to those that also target people and organizations. Behind these new attacks is a large pool of compromised hosts sitting in homes, schools, businesses, and governments around the world. These systems are infected with a bot that communicates with a bot controller and other bots to form what is commonly referred to as a zombie army or botnet. Botnets are a very real and quickly evolving problem that is still not well understood or studied. In this paper we outline the origins and structure of bots and botnets and use data from the operator community, the Internet Motion Sensor project, and a honeypot experiment to illustrate the botnet problem today. We then study the effectiveness of detecting botnets by directly monitoring IRC communication or other command and control activity and show a more comprehensive approach is required. We conclude by describing a system to detect botnets that utilize advanced command and control systems by correlating secondary detection data from multiple sources.