How Botnet And Its Detection Techniques Can Be Classified Into Four Categories

Protocol capture tools and protocol analyzers are important tools for an information systems security professional. These utilities can be used to troubleshoot issues on the network. They can verify adherence to corporate policies, such as whether or not clear text privacy data is being sent on the network. They can be used to test security countermeasures and firewall deployments and are needed to perform audits, security assessments, network baseline definitions, and identification of rogue IP devices.

Lately active defense in cyber security has been a very popular approach in protecting assets in cyberspace as well as mitigating the increase of cyber threats. Current defenses such as firewalls, antivirus, strong security policies and security patch updates aren’t sufficient enough to protect against the rapidly changing threat landscape. Many hackers can easily bypass traditional

tools will help to detect intrusions and other suspicious activities on the network. The third challenge is to improve the

After initial intrusion malicious software is installed on victim host that is re-ferred as RAT (remote access Trojan). RAT takes the responsibility to connect with attacker and regularly performed the actions that instructed by attacker. At this intruder take the full command and control (C2) over target host. The fact is that the initial connection is established by victim host, not by the attacker [6]. This will happens mainly for two reasons: (i) organizations firewall usually allows the connections initialized by internal hosts, and (ii) this will help the attacker to not to detected easily. Because intrusion detection systems [7] can easily detect the extremely suspicious activity such as downloads from outside hosts.

Until now there are still many botnets want to spread themselves. The attacker can launch Distributed Denial of Service (DDoS) through a massive botnet. Honeypot is one of the most efficient tools for detecting a botnet at the present time, but honeypot had been easily detected by botnet [24][25] before. Since we find a way to fix the problem now, we can focus on defending botnet in the future. We want to use DEH to find the C&C server that has not been found and destroy

CSEC 630 Lab2 -Intrusion Detection System and Protocol Analysis Lab (n.d.). University of Maryland University College. Retrieved from: https://learn.umuc.edu/d2l/common/viewFile.d2lfile/Database/NzkyMzkw/CSEC630_lab2_LEO.pdf?ou=33745

Botnets and their zombie armies are a real problem in the IT community as stated by Zetter. (2015) The problems that they cause are becoming more widespread and keeping computers safe is becoming more and more problematic. Additionally, the library’s ISP has put the library in a position where they must provide their cyber security, or the ISP will have no alternative to discontinuing to provide internet access to the library’s public access computers. Therefore, the solution that I have proposed to correct the problem the Wayward Pines Public Library is experiencing is not only the best option but is also considered best practice as mentioned in the prior section.

Explains what a botnet is, how it is created, used and the amount or types of data that can be collected over time. The ability to track or monitor many of these botnets by antivirus software is reported to be a very low percentage of known botnets. One of the basic principles is almost a “throw everything at it and see what sticks” mentality in that developers will employ a botnet through embedding it in a quasi-convincing spam message and hoping the reader is dumb enough to click on the link (Mittleman 67.)

These proposals and systems suggestions can minimize the vulnerabilities associated with any compromises or intrusions within the network. Deploying an intrusion detection system is an essential security strategy for monitoring a network information system for abnormal or authorized activity. An intrusion detection system (IDS) is set of tools which monitor a network topology by providing a system administrator with the overall picture of how the system is being utilized. Executing an IDS will make a difference in creating a defense in depth architecture to be more compelling in recognizing any form of malicious activities. The capacity of the IDS is to monitor and survey the network traffic without affecting network activity. IDS tools gather information and analyzes it against a pre-characterized manage set, and against a set of known assault 'marks'. The IDS can scan port numbers and to determine if any breaches or attacks are occurring (Kuipers,

Malicious bots are software applications that run automated tasks. These bots are also increasing; when they are used they create automated attacks on networks.

It uses the flaws in Windows computers to break into a computer and links other affected or unaffected computers together into a huge botnet (“Conficker”, 2015). The botnet can be controlled remotely by the author(s)’ of the worm. Conficker worm infected 9 million to 15 million Windows computers in over 200 countries in the world including government, military, business, and home computers. So far the author of this worm is still unknown (“Conficker”, 2015).

The DDoS has become the attacker’s method for finding vulnerabilities in a banks network system. A DDoS attack is when an attacker uses a botnet execution, remotely controlling multiple computers to attack the traffic of a banking system network and the attack leads to capturing the resource records of a domain name system (DNS). By using a DDoS attack some of the major components of the DNS are disrupted mainly the distributed database name server. It slows the servicing of client queries and if a disruption takes place clients will not be able to service any internet demands. The DNS uses a messaging protocol handler that runs on UDP for handling client queries and name server responses. When a malicious action such as DDoS attacks are launched the DNS messaging protocol is vulnerable to criminals who can attach other hidden software within the DDoS

This article was the summary of research conducted in order to introduce a network-request-level causal analysis for malware detection (Zhang, H. et al., 2016, p. 181). The major premise of the article was that they propose the use of algorithms to search and monitor triggering events. Triggering events that were not caused by a user action were referred to as vagabond requests (Zhang, H. et al., 2016, p. 183). Events that were occurring without legitimate cause by a user interaction, requests or initiation were viewed suspiciously as possible malware activities (Zhang, H. et al., 2016, p. 183). Examples given were DNS requests given without the user requesting it, or information being sent to a site without authorized initiation.

The internet is a medium that is becoming progressively important as it makes information available in a quick and easy manner. It has transformed communications and acts as a global network that allows people to communicate and interact without being limited by time, boarders and distance. However, the infrastructure is vulnerable to hackers who use the system to commit cyber crime. To accomplish this, they make use of innovative stealth techniques for their malicious purposes in the internet.

Botnet: This is a network of zombie computers used for malicious actions on the Internet, generally without computer’s owners the knowledge (Stallings & Brown, 2015).