Detecting BOT Victim in Client Networks

Abstract

In this paper we discuss my research in detecting bot victim in client networks. Botnets are collections of Internet hosts ("bots") that, through malware infection, have fallen under the control of a single entity ("botmaster"). Botnets perform network scanning for different reasons: propagation, enumeration, penetration. One common type of scanning, called "horizontal scanning," systematically probes the same protocol port across a given range of IP addresses, sometimes selecting random IP addresses as targets. To infect new hosts in order to recruit them as bots, some botnets, e.g., Conficker perform a horizontal scan continuously using self-propagating worm code that exploits a known system vulnerability. In this project, we focus on a different type of botnet scan-one performed under the explicit command and control of the botmaster, occurring over a well-delimited interval.