International Journal on Recent and Innovation Trends in Computing and Communication ISSN: 2321-8169

Volume: 6 Issue: 2 61 – 64
_______________________________________________________________________________________________
Different Techniques to Detect Botnet

Mitali Lade, Dr. J. W. Bakal, K. Jayamalini

Student, Department of Computer Engineering, Shree L. R. Tiwari College of Engineering, Mumbai University, Thane,
Maharashtra, India
Principal, Shivajirao S. Jondhale College of Engineering, Mumbai University, Thane, Maharashtra, India
Assistant Professor, Department of Computer Engineering, Shree L. R. Tiwari College of Engineering, Mumbai University,
Thane, Maharashtra, India

Abstract:- Botnets are now considered as one of the most serious security threats. In contrast to previous malware, botnets have the
characteristics of command and control (C&C) channel. Botnets usually use existing common protocols, eg IRC, HTTP and in protocol
conforming manners, this makes the detection of botnet C&C a difficult problem. In this paper we tend to proposed 3 techniques specifically
signature based detection, firewall IP blocking and anomaly based detection so as to detect bot and provide secure network services to the users.

Keywords- Bots, Bot implementation, Bot control, signature based detection, firewall IP blocking, Anomaly based detection.

__________________________________________________*****_________________________________________________

I. Introduction constrain command format. Our bot definition is more

general than the one proposed in [9], which required
Network security is a critical issue and a challenge to
(explicitly or implicitly) that botnet attacks be performed in
professional system developers in means of protection
a coordinated fashion and be network-detectable.
against miscellaneous attacks aimed at any resource that is
of interest to the attacker. Over the years with the increasing
2.2 Bot Implementations
number of computer systems connected to the global
A typical bot implementation consists of two independent
Internet, even the average users must be aware of the
engines: a C&C-communication-protocol processor and
external threats. Therefore, it is necessary to take some kind
a command interpreter, which interprets and executes bot
of precautions in order to protect themselves from these
commands, i.e., implements the bot's protocol. Fig 1
threats such as installation of antivirus, keeping the system
provides an abstraction of the structure of current malicious
up-to-date etc. However, from a business or an
bots, which live at the application layer of the TCP/IP stack.
organization‟s point of view, security assessments are of a
A bot protocol message (i.e., command) is generally
greater importance and must be acknowledged and valued in
encapsulated as the payload of a C&C communications
order to form the security policies that are associated with
protocol message. A bot's command syntax encodes the
an organization or a business.
actions the bot can perform as well as the ways in which
The most serious demonstration of advanced malware [1] is each can be invoked (i.e., the parameters).
Botnet. The term bot is derived from “ro-bot” which is a
combination of „roBOTNETwork’. Bot is a generic term
used to describe a script or set of scripts designed to perform
predefined functions in automated fashion. Botnet is most
widespread and occurs commonly in today‟s cyber attacks.
As a result, it creates serious threats to network assets and
organization‟s properties.
II. Bots

2.1 Definition of a Bot

Since we explore ways that a bot can be changed in order to
defeat detection, we need some baseline notion of what
constitutes a bot. A bot (I) participates in a command-and-
control (C&C) network, through which the bot receives
commands (II) which cause the bot to carry out attacks. We Fig 1: Historically, bots live at the application layer of the
do not impose temporal constraints on when the attack must TCP/IP stack, which can be further subdivided into the C&C
be carried out relative to command receipt nor do we and bot command layers.
61
IJRITCC | February 2018, Available @ [Link]
_______________________________________________________________________________________
International Journal on Recent and Innovation Trends in Computing and Communication ISSN: 2321-8169
Volume: 6 Issue: 2 61 – 64
_______________________________________________________________________________________________
2.3 Botnet Control There are some blacklisted sites which may damage our
Botnet control is achieved through a C&C network, which system. The organization named IANA (Internet Assign
consists of the: C&C protocol, which defines Number Authority) has considered some of the sites as
communication format, network topology, which identifies blacklist. For that purpose, in the second technique named
who talks to whom, and rendezvous point(RP), the location firewall IP blocking, a HTTP request coming through
to which commands are delivered. The historical view of firewall is a bot then we are blocking that IP.
botnets is that they are tightly controlled: the bot master
sends a command that is received and executed by all In the third technique we are checking whether the network
listening bots more or less immediately [10], e.g., IRC traffic is high and if so we analyze the source and if the
botnets which have latency on the order of seconds. source is invalid we are blocking it. In this we are applying
Peacomm [11]'s use of P2P for C&C demonstrates a looser port scan attack ie the IP will be scanned and log reports
control model which has higher latency since commands will be generated.
percolate through a distributed network as bot‟s poll for
them. IV. Related work
III. Problem Statement

The objective of Botnet Detection is to provide security There are several techniques for detection of botnets.
against bot. In both centralized and distributed botnets, bots However, there are 2 essential techniques for botnet
are coordinated through the C&C channel which is control detection: setting up honeynets and passive network traffic
by BotMaster. The BotMaster sends the pre-programmed monitoring [2]. Several papers mentioned about using
command to the Target Machine, and then Target (victim) honeynets for botnet detection [3][4][5][6]. But we‟ve got to
Machine starts sending its periodic information to the take into thought that honeynets cannot detect bot infection
BotMaster via Command and Control (C&C) infrastructure. most of the times and is just good for understanding botnet
To make the botnet detection more difficult BotMaster characteristics. For identifying the existence of botnets
started use of low latency anonymous communication to within the network, passive network traffic monitoring is
useful.
hide botnet with a C&C server. Currently active Bots are
hiding their identity. So it is necessary to detect and
deactivate Botnet to provide secure network service to the This technique can be classified into signature based
internet users. detection, anomaly based detection, DNS based and mining
based. Signature based detection techniques will simply be
In this project, we focus on three techniques to detect bots: used for detection of recognized botnets. Therefore, this
Signature Based Detection, Firewall IP Blocking and solution isn‟t useful for unknown bots. Anomaly based
Anomaly based detection in order to provide secure network detection techniques attempt to detect botnets based on
services to the users. This project is based on client server several network traffic anomalies like high network latency,
architecture. Initially in the first technique named signature high volumes of traffic, traffic on unusual ports and unusual
based detection we are checking that whether the internal system behavior that would indicate presence of malicious
bot is infecting our system or not. For that purpose, bots within the network [7]. DNS based detection techniques
signature of some known bots calculated from the content of are based on DNS information generated by a botnet.
bot file and that signatures are store in the database. When
the technique scans for detecting bot, it computes the As mentioned before, bots normally begin connection with
signatures of file that present in the system according to C&C server to get commands. In order to access the C&C
contents of the file and compare that signature with the server bots carry out DNS queries to locate the particular
signature present in the database. If signature of calculated C&C server that is generally hosted by a DDNS (Dynamic
file is match with the database present, then it declares that DNS) provider. Therefore, its possible to detect botnet DNS
file as an infected file and delete that particular file. The traffic by DNS monitoring and detect DNS traffic anomalies
way to create signature for bot is to use hash algorithm [6][8].
(md5, sha_1).

62
IJRITCC | February 2018, Available @ [Link]
_______________________________________________________________________________________
International Journal on Recent and Innovation Trends in Computing and Communication ISSN: 2321-8169
Volume: 6 Issue: 2 61 – 64
_______________________________________________________________________________________________
V. Design flow of project

Fig 2: flowchart of our proposed detection techniques

VI. Design Details technique we are checking whether the network traffic is
high or not and if the network traffic is high we analyze
Our proposed flowchart is based on passively monitoring whether the source is valid or invalid and if the invalid
network traffics. Fig 2 shows the flowchart of our proposed source is found we block that source and inform the server.
Botnet detection system, which consist of three techniques:
signature based detection, firewall IP blocking and anomaly
VII. Conclusion
based detection. In the very first technique we are checking
whether our system is infected by the internal bot and is so In this paper, we have discussed the flow of our proposed
we are deleting that file. In the second technique we are research work for detection of bots. We have taken the
blocking all the blacklisted IPs inorder to secure our system overview of what exactly is bot? how it is implemented and
from bots. In the third technique we are checking whether
what are the botnet controls. We have even gone through the
the network traffic is high and if so we analyze the source
different techniques which we have applied to detect the
and if the source is invalid we are blocking it. In this we are
applying port scan attack ie the IP will be scanned and log bots.
reports will be generated. Acknowledgments

Basically bots can infect our system either internally or I owe a deep gratitude towards my honourable guide, Dr J.
through external IP or through invalid source analyzed by W. Bakal. He rendered his valuable guidance with a touch
the network traffic. So detecting and deleting bots is of inspiration and motivation. I would like to thank Prof.K.
necessary in order to have a secure network services. Jayamalini, my co-guide who extended every facility and
According to our proposed flowchart initially we are helped me for completing this paper. I would also like to
checking the type of bot ie whether that bot is infecting thank my principal, Dr. S. Ram Reddy for his moral
internally or externally. If the type of bot is input, then we support..
are applying signature based detection technique and
scanning our system and if bot is detected we delete that file References
and inform the server. Again if we are getting an HTTP
request which is a bot than we are blocking the request [1] J. Zhang, Perdissci, W. Lee, X. Luo, and U. Sarfraz,
coming from those IPs and inform the server. And in the last “Building a scalable System for Stealthy P2P- Botnet

63
IJRITCC | February 2018, Available @ [Link]
_______________________________________________________________________________________
International Journal on Recent and Innovation Trends in Computing and Communication ISSN: 2321-8169
Volume: 6 Issue: 2 61 – 64
_______________________________________________________________________________________________
Detection,” IEEE Trans. Inf. Forens. Security, vol. 9, no.
1, Jan. 2014, pp. 27-38.
[2] Z. Zhu, G. Lu, Y. Chen, Z. J. Fu, P. Roberts, K. Han,
"Botnet Research survey ". in Proc. 32nd Annual IEEE
International conferences on computer software and
applications(COMPSAC)[Link] 967-972
[3] M.A Rajab, J. Zarfoss, F. Monrose, and A Terzis, "A
multifaceted approach to understanding the Botnet
phenomenon," 6th ACM SIGCOMM on Internet
Measurement Conference, IMC 2006, 2006, pp.41-S2.
[4] E. Cooke, F. Jahanian, and D. McPherson, "The zombie
roundup: Understandinng, detecting, and disrupting
Botnets," Proc. of Workshop on Steps to Reducing
Unwanted Traffic on the Internet (SRUTI'OS), June
200S.
[5] Ramachandran, Anirudh, and Nick Feamster.
"Understanding the network-level behavior of
spammers." ACM SIGCOMM Computer
Communication Review. Vol. 36. No. 4. ACM, 2006.
[6] Choi, Hyunsang, et al. "Botnet detection by monitoring
group activities in DNS traffic." Computer and
Information Technology, 2007. CIT 2007. 7th IEEE
International Conference on. IEEE, 2007.
[7] Saha, Basudev, and Ashish Gairola. "Botnet: an
overview." CERT-In White Paper, CIWP-2005-05 240
(2005).
[8] RVillamarin-Salomon and J.C. Brustoloni, "IdentifYing
Botnets using Anomaly Detection Techniques Applied to
DNS Traffic," in proceeding 5th IEEE Consumer
Communications and Networking confernce. (CCNC
2008), 2008, pp. 476-481
[9] Gu, Guofei, et al. "BotMiner: Clustering Analysis of
Network Traffic for Protocol-and Structure-Independent
Botnet Detection." USENIX security symposium. Vol. 5.
No. 2. 2008.
[10] Strayer, W. Timothy, et al. "Detecting botnets with tight
command and control." Local Computer Networks,
Proceedings 2006 31st IEEE Conference on. IEEE,
2006.
[11] Grizzard, Julian B., et al. "Peer-to-Peer Botnets:
Overview and Case Study." HotBots 7 (2007): 1-1.

64
IJRITCC | February 2018, Available @ [Link]
_______________________________________________________________________________________