Botnets - Revision history

NKirnbauer: fixed link

2024-09-25T10:01:50Z

fixed link

← Older revision		Revision as of 10:01, 25 September 2024
Line 208:		Line 208:
	== Courses ==		== Courses ==

	Ausgewählte Kapitel der IT-Security SE (2021, 2022)		[[Ausgewählte Kapitel der IT-Security]] (2021, 2022)

	== References ==		== References ==

NKirnbauer: /* Courses */

2024-08-22T18:36:19Z

Courses

← Older revision		Revision as of 18:36, 22 August 2024
Line 208:		Line 208:
	== Courses ==		== Courses ==

	* [[Ausgewählte Kapitel der IT-Security SE]] (2021, 2022)		Ausgewählte Kapitel der IT-Security SE (2021, 2022)

	== References ==		== References ==

NKirnbauer at 18:35, 22 August 2024

2024-08-22T18:35:16Z

ENachbaur: /* Architecture Types of Botnets */

2024-01-08T21:43:01Z

Architecture Types of Botnets

← Older revision		Revision as of 21:43, 8 January 2024
Line 87:		Line 87:
	[[File:hybrid.jpg\|frameless\|center\|caption]] <ref name="NAZ"/>		[[File:hybrid.jpg\|frameless\|center\|caption]] <ref name="NAZ"/>

	Additionally, there exist other examples that are more specialized in nature. Proxy botnets use compromised computers to relay commands, making it difficult to trace the source and offering enhanced anonymity. IoT botnets exploit less secure Internet of Things devices like smart cameras and routers for tasks like DDoS attacks, cryptocurrency mining, or malware distribution.<ref>T. Trajanovski and N. Zhang, "An Automated and Comprehensive Framework for IoT Botnet Detection and Analysis (IoT-BDA)," in IEEE Access, vol. 9, pp. 124360-124383, 2021, doi: 10.1109/ACCESS.2021.3110188.</ref> Social botnets involve fake social media accounts for spreading disinformation or manipulating public opinion, often driven by political or commercial motives.<ref>J. Zhang, R. Zhang, Y. Zhang and G. Yan, "The Rise of Social Botnets: Attacks and Countermeasures," in IEEE Transactions on Dependable and Secure Computing, vol. 15, no. 6, pp. 1068-1082, 1 Nov.-Dec. 2018, doi: 10.1109/TDSC.2016.2641441.</ref> Lastly, spam botnets focus on sending vast amounts of spam emails for revenue generation or distributing malicious content, utilizing compromised computers for this purpose.		Additionally, there exist other examples that are more specialized in nature. Proxy botnets use compromised computers to relay commands, making it difficult to trace the source and offering enhanced anonymity. IoT botnets exploit less secure Internet of Things devices like smart cameras and routers for tasks like DDoS attacks, cryptocurrency mining, or malware distribution.<ref>T. Trajanovski and N. Zhang, "An Automated and Comprehensive Framework for IoT Botnet Detection and Analysis (IoT-BDA)," in IEEE Access, vol. 9, pp. 124360-124383, 2021, doi: 10.1109/ACCESS.2021.3110188.</ref> Social botnets involve fake social media accounts for spreading disinformation or manipulating public opinion, often driven by political or commercial motives.<ref>J. Zhang, R. Zhang, Y. Zhang and G. Yan, "The Rise of Social Botnets: Attacks and Countermeasures," in IEEE Transactions on Dependable and Secure Computing, vol. 15, no. 6, pp. 1068-1082, 1 Nov.-Dec. 2018, doi: 10.1109/TDSC.2016.2641441.</ref> Lastly, spam botnets focus on sending vast amounts of spam emails for revenue generation or distributing malicious content, utilizing compromised computers for this purpose.<ref>M. A. R. Putra, T. Ahmad, R. M. Ijtihadie and D. P. Hostiadi, "Detecting Botnet Spam Activity by Analyzing Network Traffic Using Two-Stack Decision Tree Algorithms," 2023 International Conference of Computer Science and Information Technology (ICOSNIKOM), Binjia, Indonesia, 2023, pp. 1-6, doi: 10.1109/ICoSNIKOM60230.2023.10364480.</ref>

	Different botnet types are chosen based on the botmaster's goals and skills, each with specific functions and traits. Cybersecurity professionals and law enforcement actively strive to combat these botnets to safeguard people and organizations. Recognizing the variety of botnets is crucial for mitigating their effects in the digital world.		Different botnet types are chosen based on the botmaster's goals and skills, each with specific functions and traits. Cybersecurity professionals and law enforcement actively strive to combat these botnets to safeguard people and organizations. Recognizing the variety of botnets is crucial for mitigating their effects in the digital world.

ENachbaur: /* Architecture Types of Botnets */

2024-01-08T21:42:06Z

Architecture Types of Botnets

← Older revision		Revision as of 21:42, 8 January 2024
Line 87:		Line 87:
	[[File:hybrid.jpg\|frameless\|center\|caption]] <ref name="NAZ"/>		[[File:hybrid.jpg\|frameless\|center\|caption]] <ref name="NAZ"/>

	Additionally, there exist other examples that are more specialized in nature. Proxy botnets use compromised computers to relay commands, making it difficult to trace the source and offering enhanced anonymity. IoT botnets exploit less secure Internet of Things devices like smart cameras and routers for tasks like DDoS attacks, cryptocurrency mining, or malware distribution.<ref>T. Trajanovski and N. Zhang, "An Automated and Comprehensive Framework for IoT Botnet Detection and Analysis (IoT-BDA)," in IEEE Access, vol. 9, pp. 124360-124383, 2021, doi: 10.1109/ACCESS.2021.3110188.<ref> Social botnets involve fake social media accounts for spreading disinformation or manipulating public opinion, often driven by political or commercial motives.<ref>J. Zhang, R. Zhang, Y. Zhang and G. Yan, "The Rise of Social Botnets: Attacks and Countermeasures," in IEEE Transactions on Dependable and Secure Computing, vol. 15, no. 6, pp. 1068-1082, 1 Nov.-Dec. 2018, doi: 10.1109/TDSC.2016.2641441.<ref> Lastly, spam botnets focus on sending vast amounts of spam emails for revenue generation or distributing malicious content, utilizing compromised computers for this purpose.		Additionally, there exist other examples that are more specialized in nature. Proxy botnets use compromised computers to relay commands, making it difficult to trace the source and offering enhanced anonymity. IoT botnets exploit less secure Internet of Things devices like smart cameras and routers for tasks like DDoS attacks, cryptocurrency mining, or malware distribution.<ref>T. Trajanovski and N. Zhang, "An Automated and Comprehensive Framework for IoT Botnet Detection and Analysis (IoT-BDA)," in IEEE Access, vol. 9, pp. 124360-124383, 2021, doi: 10.1109/ACCESS.2021.3110188.</ref> Social botnets involve fake social media accounts for spreading disinformation or manipulating public opinion, often driven by political or commercial motives.<ref>J. Zhang, R. Zhang, Y. Zhang and G. Yan, "The Rise of Social Botnets: Attacks and Countermeasures," in IEEE Transactions on Dependable and Secure Computing, vol. 15, no. 6, pp. 1068-1082, 1 Nov.-Dec. 2018, doi: 10.1109/TDSC.2016.2641441.</ref> Lastly, spam botnets focus on sending vast amounts of spam emails for revenue generation or distributing malicious content, utilizing compromised computers for this purpose.

	Different botnet types are chosen based on the botmaster's goals and skills, each with specific functions and traits. Cybersecurity professionals and law enforcement actively strive to combat these botnets to safeguard people and organizations. Recognizing the variety of botnets is crucial for mitigating their effects in the digital world.		Different botnet types are chosen based on the botmaster's goals and skills, each with specific functions and traits. Cybersecurity professionals and law enforcement actively strive to combat these botnets to safeguard people and organizations. Recognizing the variety of botnets is crucial for mitigating their effects in the digital world.

ENachbaur: /* Architecture Types of Botnets */

2024-01-08T21:39:23Z

Architecture Types of Botnets

← Older revision		Revision as of 21:39, 8 January 2024
Line 87:		Line 87:
	[[File:hybrid.jpg\|frameless\|center\|caption]] <ref name="NAZ"/>		[[File:hybrid.jpg\|frameless\|center\|caption]] <ref name="NAZ"/>

	Additionally, there exist other examples that are more specialized in nature. Proxy botnets use compromised computers to relay commands, making it difficult to trace the source and offering enhanced anonymity. IoT botnets exploit less secure Internet of Things devices like smart cameras and routers for tasks like DDoS attacks, cryptocurrency mining, or malware distribution. Social botnets involve fake social media accounts for spreading disinformation or manipulating public opinion, often driven by political or commercial motives. Lastly, spam botnets focus on sending vast amounts of spam emails for revenue generation or distributing malicious content, utilizing compromised computers for this purpose.		Additionally, there exist other examples that are more specialized in nature. Proxy botnets use compromised computers to relay commands, making it difficult to trace the source and offering enhanced anonymity. IoT botnets exploit less secure Internet of Things devices like smart cameras and routers for tasks like DDoS attacks, cryptocurrency mining, or malware distribution.<ref>T. Trajanovski and N. Zhang, "An Automated and Comprehensive Framework for IoT Botnet Detection and Analysis (IoT-BDA)," in IEEE Access, vol. 9, pp. 124360-124383, 2021, doi: 10.1109/ACCESS.2021.3110188.<ref> Social botnets involve fake social media accounts for spreading disinformation or manipulating public opinion, often driven by political or commercial motives.<ref>J. Zhang, R. Zhang, Y. Zhang and G. Yan, "The Rise of Social Botnets: Attacks and Countermeasures," in IEEE Transactions on Dependable and Secure Computing, vol. 15, no. 6, pp. 1068-1082, 1 Nov.-Dec. 2018, doi: 10.1109/TDSC.2016.2641441.<ref> Lastly, spam botnets focus on sending vast amounts of spam emails for revenue generation or distributing malicious content, utilizing compromised computers for this purpose.

	Different botnet types are chosen based on the botmaster's goals and skills, each with specific functions and traits. Cybersecurity professionals and law enforcement actively strive to combat these botnets to safeguard people and organizations. Recognizing the variety of botnets is crucial for mitigating their effects in the digital world.		Different botnet types are chosen based on the botmaster's goals and skills, each with specific functions and traits. Cybersecurity professionals and law enforcement actively strive to combat these botnets to safeguard people and organizations. Recognizing the variety of botnets is crucial for mitigating their effects in the digital world.

ENachbaur: /* Architecture Types of Botnets */

2024-01-08T21:32:35Z

Architecture Types of Botnets

← Older revision		Revision as of 21:32, 8 January 2024
Line 86:		Line 86:

	[[File:hybrid.jpg\|frameless\|center\|caption]] <ref name="NAZ"/>		[[File:hybrid.jpg\|frameless\|center\|caption]] <ref name="NAZ"/>

			Additionally, there exist other examples that are more specialized in nature. Proxy botnets use compromised computers to relay commands, making it difficult to trace the source and offering enhanced anonymity. IoT botnets exploit less secure Internet of Things devices like smart cameras and routers for tasks like DDoS attacks, cryptocurrency mining, or malware distribution. Social botnets involve fake social media accounts for spreading disinformation or manipulating public opinion, often driven by political or commercial motives. Lastly, spam botnets focus on sending vast amounts of spam emails for revenue generation or distributing malicious content, utilizing compromised computers for this purpose.

			Different botnet types are chosen based on the botmaster's goals and skills, each with specific functions and traits. Cybersecurity professionals and law enforcement actively strive to combat these botnets to safeguard people and organizations. Recognizing the variety of botnets is crucial for mitigating their effects in the digital world.

	==Propagation==		==Propagation==

APruka: Added detection techniques

2023-01-07T16:30:38Z

Added detection techniques

← Older revision		Revision as of 16:30, 7 January 2023
Line 103:		Line 103:

	It happens when the users downloads a file voluntarily. For example, if some visitors who want to watch a movie on an illegal movie site tells the visitors to click on the link below and download the file to watch the movie, if the user does this, it means users is probably downloading a malware to machine with their own hand. At the end of this, their own machine will also turn into a bot. The users will click on the referral link from a trusted but hacked account and reach a fake youtube site. When the users watches the video here, they actually downloads a malware to their computer. The result takes its place in the zombie army again.		It happens when the users downloads a file voluntarily. For example, if some visitors who want to watch a movie on an illegal movie site tells the visitors to click on the link below and download the file to watch the movie, if the user does this, it means users is probably downloading a malware to machine with their own hand. At the end of this, their own machine will also turn into a bot. The users will click on the referral link from a trusted but hacked account and reach a fake youtube site. When the users watches the video here, they actually downloads a malware to their computer. The result takes its place in the zombie army again.

			==Detection techniques==

			===Anomaly-based detection===
			Anomaly-based botnet detection is about detecting different network irregularities,
			such as high network latency, unusually high traffic, traffic on unusual ports or unusual system behavior.
			Such irregularitites are so-called anomalies.
			Detection based on anomalies can be divided into two subcategories: Host-based and Network-based techniques.

			====Host-based techniques====
			The strategy for host-based botnet detection is to analyze the host machine itself.
			The analysis is based on examining various parameters and predetermined commands that bots receive from their C&C server.

			BotSwat is a scanner developed to identify a host as a bot.
			The scanner monitors the so-called "execution status" of the Win32 library and observes runtime system calls, which are created by a processor.
			The problem with the BotSwat technique is malicious code can be hidden by code injection in harmless processes.
			Thus, the bots remain unnoticed.

			Another detection technique is based on the analysis of multiple log files.
			Since bots act much faster than humans, the time needed for a complete request & response cycle can be used to determine whether the request came from a human or a bot. This technique can
			be used for IRC as well as for non-IRC botnets. A tool called BotTracer has been developed for this method.

			BotTracer divides the life cycle of a bot into three phases (Startup, Preparation, Attack). In the startup phase, the bot is successfully im- planted in the target system.
			Afterwards, in the Preparation phase, the bot connects to the C&C server and waits for its commands.
			Finally, the botmaster sends its commands to the bots (Attack Phase).
			BotTracer tries to recognize the three phases and to find out where the connection with the bot is going.
			After that the traffic is compared with already known properties of C&C channels.
			The fundamental disadvantage of this technique is that it is not possible to detect the existence of virtual machines

			====Network-based techniques====
			In the network-based detection technique, attempts are made to detect botnets by examining the network traffic.
			The network-based techniques are divided into two subcategories, Active Monitoring and Passive Monitoring.

			=====Active Monitoring=====
			Active monitoring is based on the possibility of injecting test packets into the network.
			This produces extra traffic, but the response time of the network can be measured.
			The current best strategy for Active Monitoring is BotProb.
			BotProbe takes advantage of the fact that bots usually send commands according to certain predefined patterns.
			BotProb injects its packets into the network to find these patterns.
			This deterministic approach can effectively prove the existence of bots.

			=====Passive Monitoring=====
			Passive monitoring inspects the traffic while the network is in use.
			The traffic is analyzed by various anomaly detection techniques (distance-based techniques, support vector machines, neural networks, cluster analysis, and learned rules).
			Unlike active monitoring, no additional traffic is generated.

			BotSniffer is a framework used for passive monitoring.
			The idea is that bots within the same botnet are very likely to have similarities in their activities.
			If bots are detected then the corresponding hosts are clustered together.
			An alarm is then triggered with a warning that the hosts in the cluster may be infected.
			For the detection of the bots, log files are used.
			Here, the log files store the incoming and outgoing traffic with the start time for the execution time of the started processes.
			Several correlation analysis algorithms are used for the analysis.

			===Honeynet-based detection===
			The term honeynet describes a network of real network components that intentionally uses components with vulnerabilities.
			This allows attackers to be distracted from the actual network.
			The honeynet is divided into two subcategories:

			# Honeypot
			# Honey-Wall

			====Honeypot====
			The honeypot is a mechanism for detecting unauthorized access to a system.
			As the bots infect the network, the honeypot collects information, such as the bot characteristics and the intent of the Botmaster.

			There are three types of honeypots:

			''Low-interaction honeypots'' have only a limited number of services.
			Furthermore, the honeypot's interaction is severely limited.
			Often they communicate here only with dummy messages.
			This type of honeypot is usually only used to collect statistical information.
			The configuration and maintenance of this honeypot is very simple.
			However, an attacker can quickly detect that his target network is a honeypot.

			''Medium-interaction honeypots'' are very similar to low-interaction honeypots.
			They also have limited services, but with a greater level of interactions.
			The purpose of this type of honeypot is to get an attacker to continue his attack with the ability to send his payload.

			''High-interaction honeypots'' are the most advanced honeypots.
			They have an interactive operating system with which the attacker can interact.
			This complexity makes the installation and maintenance of the system the most demanding, but it also allows the most information to be collected.
			By imitating a complete system, appropriate preventive measures are needed in case the attacker compromises the system to use it for his attacks.

			====Honey-Wall====
			A honey-wall is used to protect honeypots from attacks.
			It acts as a gateway for the honeypots and collects all traffic from the honeynet system.
			Through the honey-wall, the network acquires the functions of ''Data Capture'', ''Data Control'' and ''Data Analysis''.
			# Data Capture states that all actions within the network should be captured without the attacker being aware of it.
			# Data Control aims to protect the Internet from compromising Honeynet systems. All data that enters or leaves the network is stopped.
			# Data Analysis supports the analysis of the collected data.

			Honey-wall simplifies the collection and analysis of data and also helps to control what data enters and leaves the network.
			However, a firewall is needed to verify the authenticity of the user.

	==Conclusion==		==Conclusion==

RAlaca: /* Centralized (Client-Server) Architecture */

2022-01-04T16:50:41Z

Centralized (Client-Server) Architecture

← Older revision		Revision as of 16:50, 4 January 2022
Line 73:		Line 73:
	2012.</ref>		2012.</ref>

	[[File:cent.jpg\|frameless\|center\|caption]] <ref name="Rag"/>		[[File:cent.jpg\|frameless\|center\|caption]]<ref name="Rag"/>

	===Decentralized (P2P) Architecture===		===Decentralized (P2P) Architecture===

RAlaca: /* Decentralized (P2P) Architecture */

2022-01-04T16:50:26Z

Decentralized (P2P) Architecture

← Older revision		Revision as of 16:50, 4 January 2022
Line 79:		Line 79:
	p2p botnets. In 2014 IEEE 12th International Conference on Dependable, Autonomic and Secure Computing, pages 97–102, 2014</ref> The client bots are attacked by the C&C servers. Once a client is attacked, all the other clients that communicate with the infected client gets attacked. The infected bots communicate with other bots and send the malicious codes to them in the event of P2P communications shown in Figure 3.<ref name="Rag"/>		p2p botnets. In 2014 IEEE 12th International Conference on Dependable, Autonomic and Secure Computing, pages 97–102, 2014</ref> The client bots are attacked by the C&C servers. Once a client is attacked, all the other clients that communicate with the infected client gets attacked. The infected bots communicate with other bots and send the malicious codes to them in the event of P2P communications shown in Figure 3.<ref name="Rag"/>

	[[File:decent.jpg\|frameless\|center\|caption]] <ref name="Rag"/>		[[File:decent.jpg\|frameless\|center\|caption]]<ref name="Rag"/>

	===Hybrid Architecture===		===Hybrid Architecture===

← Older revision		Revision as of 18:35, 22 August 2024
Line 26:		Line 26:
	user devices that have malicious bots in their system are also considered as bots. It is		user devices that have malicious bots in their system are also considered as bots. It is
	also called a zombie. A bot master is someone who codes bots and infects computers		also called a zombie. A bot master is someone who codes bots and infects computers
	over the internet. The infected computers are an army of zombies under ~~his~~ command.		over the internet. The infected computers are an army of zombies under their command.
	They manage bots via a control and command structure. ”A command and control		They manage bots via a control and command structure. ”A command and control
	architecture is a structure that issues commands to a botnet and receives reports back		architecture is a structure that issues commands to a botnet and receives reports back
Line 180:		Line 180:
	This type of honeypot is usually only used to collect statistical information.		This type of honeypot is usually only used to collect statistical information.
	The configuration and maintenance of this honeypot is very simple.		The configuration and maintenance of this honeypot is very simple.
	However, an attacker can quickly detect that ~~his~~ target network is a honeypot.		However, an attacker can quickly detect that their target network is a honeypot.

	''Medium-interaction honeypots'' are very similar to low-interaction honeypots.		''Medium-interaction honeypots'' are very similar to low-interaction honeypots.
	They also have limited services, but with a greater level of interactions.		They also have limited services, but with a greater level of interactions.
	The purpose of this type of honeypot is to get an attacker to continue ~~his~~ attack with the ability to send ~~his~~ payload.		The purpose of this type of honeypot is to get an attacker to continue their attack with the ability to send their payload.

	''High-interaction honeypots'' are the most advanced honeypots.		''High-interaction honeypots'' are the most advanced honeypots.
	They have an interactive operating system with which the attacker can interact.		They have an interactive operating system with which the attacker can interact.
	This complexity makes the installation and maintenance of the system the most demanding, but it also allows the most information to be collected.		This complexity makes the installation and maintenance of the system the most demanding, but it also allows the most information to be collected.
	By imitating a complete system, appropriate preventive measures are needed in case the attacker compromises the system to use it for ~~his~~ attacks.		By imitating a complete system, appropriate preventive measures are needed in case the attacker compromises the system to use it for their attacks.

	====Honey-Wall====		====Honey-Wall====