International Journal of Recent Technology and Engineering (IJRTE)

ISSN: 2277-3878, Volume-8, Issue-1, May 2019

Botnet Detection Techniques – An Analysis

Jwala Sharma, Samarjeet Borah

 discussed. Contents of the paper are organized in the

Abstract: A botnet is a network of computers that has following way: Section II discusses the overview of botnets
been compromised under the influence of malware code along with architecture, Section III discusses some real
and being controlled by botmaster remotely. Every single botnets, section IV discusses about botnet detection
day botnets develop new evasion techniques to make their techniques and some of the related works, section V discusses
presence undetectable. Knowing the consequences of about the comparative analysis about different detection
botnets attacks; security analyzer must develop more robust methods and section VI is about the conclusion.
detection methods. In this paper, an overview of botnets
along with some real example of the same i.e. rustock, II. BOTNETS
waledac, zeus, conficker are given. Signature based
detection technique focuses on pattern, such as network A botnet is a network of computers that has been
traffic and then search for the known malicious pattern compromised under the influence of malware (bot) code and
only. Therefore, to detect unknown attacks a robust being controlled by botmaster remotely. It works on
detection technique is required. Anomaly-based detection command and control mechanism, once the system has been
techniques are used in such cases. Analysis of compromised, after bot code or malware bring installed on it,
anomaly-based detection techniques are probed in this the system becomes a bot or a Zombie. These bots distribute
paper. themselves over the internet by finding vulnerable or
Keywords : Botnet, Security, Botmaster, Signature Based unprotected computer system that they can infect and further
Detection, Anomaly Based Detection create a network of Zombies [3]. There are different botnets
available across the internet, despite being different, their
I. INTRODUCTION activities are common. The activity refers to the botnet
actions they perform during their life time, which is referred
The recent internet landscape has reached the era which is as botnet life cycle: spread and infection, hiding and
much more than just human and machine interaction, the securing, command & control, launch, attack etc. Therefore,
trending such one is “botnets”, bot being derived from word to address arising problem of many botnet detection
robot and net from network, bot being able to perform techniques have been proposed in the past years; meanwhile
repetitive task and can establish a connection among spammers continue to upgrade their evasion techniques to
networking users and having an ability to mimic human make their presence undetectable.
behavior are rapidly growing all over the internet.
A. Common Components of a Botnet
Number of factors contributes to the growth of digital data,
which has resulted in enormous data generation and sharing  Command and control server: C&C are the
of this data worldwide throughout internet users, be it social centralized server that issues commands to bots
networking sites, email service, websites, botnets are and receives reports or information from bots. The
becoming a severe threat to network security. E-mail services two main are C&C mechanisms used by botnets
widely being used to exchange information, personal are centralized and decentralized.
information, cooperate information has resulted with the
 Peer to peer botnet: P2P operate without having
emerging of unsolicited message, usually known as spam.
Botnets are used in wide variety of application which are any structure, and it can include C&C server too
responsible for performing malicious activities like  Botmaster: Also known as controller or bot
Distributed-denial-of-service (DDOS), mass spamming, herder. It remotely controls the botnet using C&C.
phishing, identity theft, DNS spoofing, click frauds, adware  Bot: A host that has been compromised by
installation etc. [1], [3]. It is estimated that 269 billion emails malware code or bot code. It can be IOT, smart
[2] are sent every day, so with the dependency on use of email phone or computer.
services has created a lot many problems as it is very
annoying for the users who do not wish to get flooded their B. Botnet Architecture
mailbox with advertisement link, fraudulent links, and for Use of command and control infrastructure as one of the
innocent users who fall for such scams. In this paper, study of important characteristics of botnet makes them different
different real botnets and their evasion techniques has been from any other type of malware [4]. Botnet works on
command and control mechanism and it has mainly two
types: centralized and
Revised Manuscript Received on May 27, 2019.
Jwala Sharma, Department of Information Technology, DDE, Sikkim distributed or decentralized.
Manipal University, Sikkim, India 1. Centralized Architecture
Samarjeet Borah, 2Department of Computer Applications, Sikkim
Manipal Institute of Technology, Sikkim, India

Published By:
Blue Eyes Intelligence Engineering
Retrieval Number: A1903058119 /19©BEIESP 2130 & Sciences Publication
 Botnet Detection Techniques – An Analysis

Botmaster uses central server to give commands to selected detection, bot uses binary obfuscation, to confuse the
set of bot, they make use of protocols such as internet relay detector, similar anti-analysis, security suppression; rootkit
chat or hypertext transfer protocol to operate their technology is used by bots as an evasion technique.
operations. Botmaster uses C&C to remotely control the botnets.
Internet relay chat (IRC) [5] is based on instant messaging Therefore, if detection technique can find out this C&C
protocol over internet and works like client server server, whole botnet can be brought down. This can be
architecture. Botmaster creates IRC channel on command performed by tracing the IP generated by the C&C server. To
and control server and sends command to it, which on return make their presence undetectable, botmaster implements IP
relays the command to the client through Zombie is created. Flux, Domain Flux, Rouge DNS server techniques. Many
After the successful installation of bot on the victim host, other evasion techniques used by C&C includes encryption of
client executes the commands and reports their result back to the communication traffic, protocol and traffic manipulation.
the botmaster. Centralized architecture often suffers single
point failure as they can be easily traced and blocked by the III. REVIEW OF BOTNETS
administrators using firewall. Because of the restriction on
IRC, spammers began to use HTTP protocol to hide their In this segment generic characteristic of real-world botnets
activities. Using HTTP was quite advantageous for the are explained. Botnets use various method to propagate
spammers as HTTP traffic are used in wide range for the across the network and infect the machine, over the time as
services it provides, further they can avoid being detected by many security researches are coming up with new detection
the firewalls. Still using HTTP in centralized architecture techniques, meanwhile spammers and botnet developers are
suffers from a single point of failure, because the working of keeping pace to come up with anti-detection techniques.
the network and distribution of commands from the As per the research the oldest internet bot can be traced
botmaster heavily relies on the central server. back to 1988, with the appearance of IRC, internet relay chat.
2. Distributed Architecture And so the era of botnets emerged with other bots like web
crawlers for the first search engines to index the web pages in
[5] Absence of centralized server, where each bot is a peer 1994 and with this came up other malwares like Trojan,
acting as a server and as a client at the same time. It is based worm etc.6
on P2P protocol, in this architecture botmaster sends
The popularity of botnets continued to grow and created
commands to more than one bot and they deliver the
chaos in the history of internet and is still on the run. So here
commands to its neighbors and they form a formation by
are some the most dominant botnets that has created an
connecting to each other. It doesn’t suffer from single point
emergency over internet in the past and still are in run to
of failure as in this architecture if one bot is detected by IDS,
elude their presence.
only it is, and its neighbor is affected not the entire network.
The spontaneity of framing a network of bot in this  Bagle: It is a mass mailing computer worm first
architecture is often slow in convergence, having suffering sighted in early 2004. It used SMTP engine to mass
form greater response time, it becomes difficult to manage mail to the infected computers. It made a copy of
the network and lacks in scalability in the whole discourse. itself in Windows system and opened a backdoor on
TCP. It was estimated that it infected 150,000 to
C. Botnet Features 230,000 systems before it was brought down at
January 18 2004.6.
Understanding the features of botnet is very important for
the detection of them. Botnet features vary through a large  Rustock: It was dominant in the year 2006 until it was
category [22]; propagation methods can be active or passive. brought down in 2011. It consists of computer
In the active propagation method bots disseminate through system running Microsoft windows as their
scanning open ports and passive propagation is derived by operating system. It was estimated that it was able to
drive by downloads, removable media, and social send 25,000 spams per hour and at an average 192
engineering. per minute. It gained its popularity at that era
because of the Rootkit technology it implemented to
Another way of understanding the botnets is to know their
keep their presence undetectable. Rootkit is a
purpose, information gathering, distributed computing,
software program designed to enable access to
DDOS attacks, cyber fraud, spreading malware, identity theft
computer system being unauthorized user, it simply
is some common.
means that attacker obtained administrator /root
One of the popular techniques, honeynet is very useful to access and it can install any malicious code it
understand the topology of the botnets in the network, the wanted to.6,[11]
centralized architecture, where the use of central server is
 Storm: It was created in 2004 and first identified as
made to give all the commands to the bots in the network, is
botnet on September 2007. It distributed email with
quite a simple topology, which lacks robustness and can be
different subjects once such subject was “230 dead
easily bought down. To make the network more robust,
as storm batters Europe “. It comprises of computer
decentralized or P2P topology is implemented, where each
running in Microsoft windows, once the computer
bot acts as a server and a client at the same time. Even, more
was infected with malicious code, it becomes a bot
sophisticated topology is implemented, by combing the both,
and it starts to
that is hybrid topology.
perform automated
In order to make their presence imperceptible bots uses tasks like gathering
evasion techniques. When traffic is monitored for malware

Published By:
Blue Eyes Intelligence Engineering
Retrieval Number: A1903058119 /19©BEIESP 2131 & Sciences Publication
 International Journal of Recent Technology and Engineering (IJRTE)
ISSN: 2277-3878, Volume-8, Issue-1, May 2019

data, attacking websites, and forwarding emails. It the most popular techniques is implementation of intrusion
used P2P architecture to create its network and the detection system (IDS); it is a software application that
method used by storm to propagate were websites monitors a network or system for malicious activity. It is
offering free music. On September 25 2007 further classified as Network IDS and Host IDS. HIDS is a
Microsoft update Windows malicious software system that monitors operating system files. NIDS is a system
removal tool which helped to reduce the botnet size that analyzes incoming network traffic and is placed at some
and on 2008 its storm declined until 2010 point within a network to monitor traffic to and from all the
Stormbot2 was back with the absence of P2P devices.
architecture, which it used earlier.6,9 In this section, a review of botnet detection mechanism has
 Torpig: it began its development 2005. At its initial been carried out. The study is arranged in the following
stage it spread through phishing emails. The manner:
infection method torpig used was
A. Categories of Detection Methods
drive-by-downloads, where users are not required to
click on any ad, as malicious ad recognizes old 1. Signature Based Techniques
software version in system and download will It is a detection technique that looks for the specific
commence without any indications. It gained its pattern, such as network traffic and look for the well-known
popularity by taking the advantage of outdated malicious pattern in the payload. It basically generates spam
version of java, flash. After spreading and infecting signature and characterize the botnets that perform malicious
the system, torpig during its main stage, collects and activities by examining the context and its traffic properties.
report information like financial data, credit card This technique is widely used for detecting the known
numbers, banking account credentials, windows attacks, i.e. the pattern or signature is already identified and
password etc. it was estimated that 70 GB data was kept in the log. So basically, it suffers from one limitation
stolen and redirected.[6] and that is it cannot detect new or unknown attacks [5].
 Conficker: It was first detected on 2008; it was a 2. Anomaly Based Detection
computer worm mainly targeting Microsoft
windows operating system. It propagates by It was later introduced with the purpose of detecting
exploiting MS08-67 vulnerability in server service unknown attacks. In this technique a Machine learning
which then gives complete control of the infected approach has been proposed where a model is created, and it
machine remotely to attacker. It infected millions of is trained to recognize all the activities of a system and
government business, and over 9 to 15 million network. At initial a model is created and this model goes to
systems were infected by conficker.11,6 two or more phases one of which is training phase during
 Zeus: It used spam emails and drive-by downloads as which a profile is created by feeding the model with different
its infection methods. It was used to steal banking traffic pattern and combination of malicious activities and
information. It was early identified on July 2007. It later compared with new behavior against this model in
second phase called as testing phase, so bots that belong to
was said that it was the largest botnet on the internet
same botnet is likely to have similar behavior during their life
as it was very difficult to detect. It mainly targeted
time, so using this technique we can find behavior that
business to capture password. Later it was said that
similar to host and try to detect bots by correlating similar
it stopped after the possible retirement of the behavior. Anomaly based techniques enables detection of
creator.6,11. previously unknown attack or pattern that has not been
registered but it may suffer from false positive, it may result
in error while reporting the activity test result may indicate
IV. BOTNET DETECTION TECHNIQUES presence of any condition which is not present.
Botnet detection is one of the imminent tasks of any cyber Anomaly detection techniques have been categorized as
security. In the past years as the botnets are emerging with unsupervised anomaly detection, supervised anomaly
new techniques and architecture to make themselves detection and semi-supervised anomaly detection [24]. We
undetectable and cyber security and researcher are also have a wide variety of application of anomaly detection
coming up with countermeasures to stop the malicious techniques such as Intrusion detection, fraud detection,
activities. Spammers are using IP address flux, domain flux, system health monitoring, removing anomalous data from
encrypted communication, rootkit techniques to elude data set. In this study we focus on anomaly-based botnet
tracing. IP address fluxing is used in waledac and storm as an detection approach, the study has been done on the basis of
evasion technique. Domain flux is another technique used by different examples taken from the literature and which is
conficker, torpig, zeus where in botmaster changes the employed using either one of three approaches: static,
domain name of C&C server periodically in order to elude dynamic or hybrid, which specifies the way in which the
tracing and shutdown attempts. 6 Rootkit techniques is information is gathered.
another way in which a bot gets access to computer system as 3. Dynamic Anomaly Based Detection
an administration and installs the malicious activity and also
keeps its presence undetectable. Botnets are coming up with
anti-detection techniques and creating havoc across the
internet, so for the secure and reliable communication cyber
security needs to build up strong defense mechanism. One of

Published By:
Blue Eyes Intelligence Engineering
Retrieval Number: A1903058119 /19©BEIESP 2132 & Sciences Publication
 Botnet Detection Techniques – An Analysis

As stated earlier this approach had two main phases it is unable to detect attacks that have been done using other
namely training phase, also referred as learning phase in protocol other than TCP, like UDP, ICMP, ARP and it
which the detector/model learns about the regular behavior of cannot detect attack that do not contain payload as its model
the system or the host and during detection phases also is computed using payload part.
known as monitoring phase, it monitors the program during
Data mining is the process of knowledge discovery from
its execution and will check for the any irregularity or any
large amount of data, finding the interesting patterns,
kind of contradiction with the pattern that has been learned
analyzing the data and presenting the useful information for
during training phase. During dynamic approach the model
the heterogeneous data set. It has a wide variety of
tries to detect or determine the malicious activities during
applications around the world medical field, market analysis,
program execution or after program execution.
fraud detection, risk analysis and management and may
B. Related Works others.
In this section, different techniques from literature for In the field of intrusion detection, lee and stolfo has
detection of botnets are presented along with an analysis. purposed data mining technique [13], using association rules
and frequent episodes. Association rule is considered to
Payload based anomaly detector, Ke Wang & Salvatore
satisfy both the minimum threshold and minimum
presents PYAL [12] a anomaly based detection techniques in
confidence threshold, so its major goal is to derive multiple
which the normal application payload of a network traffic is
feature correlation from database table and form a rule set.
modeled, under unsupervised data and the model is deployed
For the effective intrusion detection enough, training data is
in environment with high bandwidth like firewall, network
required to derive the knowledge. Each record in a database
appliance or target host. PYAL is used for calculating the
table is a set of items, association rule expression x=>y,
expected payload for each port or service on the system.
confidence, support, where x and y are subset of item in
Network payload is basically a stream of bytes which does not
record.
have a fixed format. To model payload stream of bytes are
divided into small clusters based on some criteria and later Rule set are created that consists different aspect of the
associated with similar stream. Network service provides target system, normally the knowledge about how system
port numbers that are fixed integer number ranging from behaves in normal state. Lee and stolfo in their work have
0-65,535 like 20 used for FTP data, 21 FTP command, 22 constructed base classifier that models different aspect of
SSH, 23 TELNET, 80 HTTP and so on. Each application on target system. Meta detection agents use information from
a system has its own port number or a service number. multiple base detection agents and this information is audit
Payload model is computed for different length range for data, which are generally data streams that have been
each port and service which is a characteristic of a normal processed for detection purpose, in this case authors have
payload. used tcpdump output. Mining based detection techniques is
now used to execute rule set on audit data (tcpdump) and
Once the characteristics of normal payload has been
after doing the manual analysis of normal behavior and
identified, system is made to learn about the profile that
abnormal behavior anomalous data were detected.
created during the first phase that is learning phase and it is
assumed that, it is a normal behavior or expected payload of Wei Lu and Ali a Ghorbani proposed a network signal
the traffic during normal functioning of a system. Anomaly modeling technique for detecting network anomalies [14].
detection phase begins during a learning phase when a Wavelet having specific properties that can be used in signal
Centroid model is computed, (grouping of similar set of processing, for conveying information about the behavior or
objects, in which object in same group is called as cluster, attributes of the sound. Wavelet analysis technique has been
and cluster is represented by central vector, where number of widely used for anomaly detection in past, the technique
cluster is K which is fixed), which analysis the network differs in the approach used. The architecture proposed by
traffic and captures incoming payload and test the payload Weilu and Ali A. Ghorbani consists of some major
for any inconsistencies from the centroid model using components as such, feature analysis, normal network traffic
Mahalanobis distance metric (it is distance metric used to modeling based on wavelet approximation and prediction by
compare the similarity between the new payload and the ARX (Auto Regression and Exogenous) model and intrusion
previously computed model). If the incoming payload is too detection. During the process fifteen attributes of network
far from the centroid model, which means the Mahalanabis traffic behavior has been identified, which are different from
distance value is large, then the payload is malicious, or we the current existing wavelet-based network anomaly
can say if any new payload is found to be too far from the detection technique as it has a smaller number of attributes to
expected payload then it is malicious, and an alert is define the traffic behavior. Normal daily traffic is modeled
generated and accordingly a decision is taken. based on the attributes of network traffic that have been
identified and is represented by set of wavelet approximation
Ke Wang & Salvatore implemented this technique with
coefficients which is predicted by ARX model. The major
1999 DARPA IDS data set on MIT Lincoln lab. The network
focus on this paper is identifying and choosing fifteen
traffic was evaluated and logged in tcpdump format, after 3
network flow-based features which characterize the network
weeks of training data and two weeks of test data. Out of 201
traffic input function.
different attacks in Lincoln lab, out of which 97 should have
been detected but the author’s technique could detect only 57
attacks. This technique has been applied only to focus TCP
network traffic, so PAYL suffers from certain limitations, as

Published By:
Blue Eyes Intelligence Engineering
Retrieval Number: A1903058119 /19©BEIESP 2133 & Sciences Publication
 International Journal of Recent Technology and Engineering (IJRTE)
ISSN: 2277-3878, Volume-8, Issue-1, May 2019

Anomaly in a network can be caused by several reasons, as the similarity analyzer estimates group similarities and
such discussed by M H Bhuyan in his paper focuses on botnet reporter summarizes /reports results.
security related anomalies is caused by activity of intruder
BotGAD implemented in TCP/UDP traffic generates many
who hijack the bandwidth by intentionally flooding the
false positive. Therefore, only DNS-based botnet can be
network by unnecessary traffic [15]. ANIDS, anomaly
evaluated using this technique, which makes this technique
network intrusion detection system consists of components
structure and protocol dependent.
such as detection engine, which is a heart of NIDS, attempts
to detect occurrence of any intrusion either online or offline. An anomaly-based approach is proposed that do not
Anomaly based approach is used to detect unknown attacks require any previous knowledge of bot signatures, protocols
based on matching mechanism. By continues monitoring of of botnet or any C&C server address that refer to bots
network, a pattern or profile can be built, matching properties. Sajjad Arshad et al. [18] has proposed a prototype
mechanism determines whether the new instance belongs to system to evaluate a real world network traces along with
a known class defined (profile built) or not. The reference normal traffic to find the presence of bots. The main
data another component of ANIDS stores information about approach is to cluster bots of similar netflows and find the
known intrusion signature of profile of normal behavior. The behavior similarities of host in different properties such as
storage space is required to store intermediate results, known netflow information through a predefined time window and
as configuration data (partially created intrusion signature). to detect bots by correlating these similar behaviors between
Any kind of indication received by detection engine is raised different time window.
by alarm component of NIDS architecture, a human analyst The architecture for botnet detection approach consists of
is required to interpret and analyze the alarm raised and take nine interconnected components that analyze traffic online.
the necessary action. A profile needs to be updated by
security manager as per the decision taken by analyst which The components work in the following manner
is known as pre-processing activity. Traffic capturing is the  Traffic dispatching component delivers traffic to
major component of NIDS; the traffic is captured at packet Domain-IP Mapping, Netflow Generating and Alert
and flow levels, preprocessed and send to detection engine Generating components.
for the process.
 Domain-IP Mapping component maps the DNS
Guofei Gu et al.,[16] proposed network-based anomaly domains to corresponded IPs for filtering purposes.
detection approach to identify botnet C&C channels. A
prototype system botsniffer is made to capture  Netflow generating component generates TCP netflows
spatial-temporal correlation in network traffic and utilize between hosts.
statistical algorithm to detect botnet using many real-world  Alert Generating component reports the malicious
network traces. In the centralized architecture botmaster uses activities of the hosts like scanning.
either push or pull to propagate to reach bots. In push style
C&C commands are pushed or sent to bots e.g. IRC based The other five components, Alert filtering component
C&C, botmaster has real-time control over the botnet. C&C filters useless alerts generated by Alert generating
is loose in pull style because there is a delay in between the component and Netflow Filtering filters the netflows
time when botmaster issues a command and the time when generated by Netflow generating component, at the end of
bot gets the command, e.g. HTTP based C&C. By observing each time window.
the spatial-temporal correlation and similarity nature of The proposed technique is based on the perception that all
these botnet, a set of heuristics is derived that differentiate bots respond to command and perform malicious activates in
C&C traffic and normal traffic. An anomaly-based detection a similar fashion, but as we know the trending botnets are
algorithm is implemented to identify both IRC and HTTP structure independent and uses different evasion techniques
based C&C. Botsniffer is implemented as plug and play for to hide. The major drawback of this technique is that it is
open source snort. unable to detect botnets which refer to different structure.
Since this technique is IRC and HTTP based, it is restricted The result also reflects that the efficiency of netflow
to botnet that uses IRC and HTTP protocols. Botsniffers is clustering algorithm is low.
unable to detect protocol and structure independent botnets.
A method to detect, track and characterize botnets on a
Botnet group activity detector is based on group activity large-scale network is found [19]. The method is passive and
model and metric. [17] Hyunsang Choi et. al. has proposed a is invisible to operators. A. Karasaridis, et al., has developed
DNS based BotGAD model which consists of four parts: an anomaly-based passive analysis algorithm that detect IRC
a) Data Collector, botnet controllers. It works on different phase, data collection
b) Group classifier, process, a botnet controller, which is evaluated by botnet
c) Similarity analyzer detection algorithm.
d) Botnet reporter. The detection technique is implemented on a large-scale
IRC, HTTP, P2P are widely used botnet protocols for network, which has low false positive rate and can also detect
communication. Incoming and outgoing traffic is monitored encrypted communication.
at network gateway by data collector, group classifier makes
groups from traffic using predefined group size threshold,

Published By:
Blue Eyes Intelligence Engineering
Retrieval Number: A1903058119 /19©BEIESP 2134 & Sciences Publication
 Botnet Detection Techniques – An Analysis

The trending botnets are structure and protocol The procession capability of this technique is very good,
independent which makes them powerful and can easily and accuracy of detection is also achieved as proposed in the
evade the current detection techniques, therefor the current paper.
techniques proposed is structure dependent and evolution of
A limitation of the proposed research is that it considers
botnets cannot be accommodated.
TCP traffic only to detect botnets, so if in case botnets uses
Botnet detection method analyzes the social relationship UDP packets for communication then this approach may not
between nodes. In this paper Jing wang and Ioannis ch has be able detect the botnets.
proposed a method that do not focus on C&C channels of
A real time botnet detection mechanism which basically is
botnets, instead botnet is detected by analyzing the social
a proactive measure has been proposed in this paper [23]. A
relationship, modeled as graphs of nodes.
payload independent botnet detection approach is used to
For detection of bots analyzing the social relationship prepare a dataset from the traffic and based on the
nodes are required, which are modeled as graph of nodes. classification and clustering algorithm essential features
from the traffic is extracted. Implementing
For this purpose, Jing Wang [Link] has proposed two social
expectation-maximization clustering algorithm, a real-time
graphs in his paper:
botnet is detected.
 Social interaction graphs (SIG) in which two nodes are
A clustering-based detection technique proposed by Pijus
connected if their interaction between them.
has a strong underlying theoretical support and inferred from
 Social correlation graph (SCG) in which two nodes are the real world.
connected if their behavior is correlated.
As we are aware of the botnets constantly evolving nature
The technique proposed has two main stages, in network and they come up with new techniques of avoiding of
anomaly detection stage, SGI model is constructed as a avoiding detection, as a result use of this technique may
reference model and threshold vale is set. The model is then result in false negative.
monitored for nay abnormal SIG. Another stage is botnet
Real world data consists of sensitive information,
discovery, is triggered whenever the threshold value is higher
generating real world network traces is another drawback in
than the earlier set threshold value. Such highly interactive
this approach.
node is referred as Pivotal nodes. Botmaster and target
frequently interact with bots, which leads to categorize them
as Pivotal nodes. The interactions between bots and Pivotal V. ANALYSIS
nodes should be correlated; therefor to make this correlation Botnet is a network of computers which works on
SGC is constructed. The community that has high interaction command and control mechanism, there are different types of
with Pivotal nodes in the SGC model is likely to be detected botnets available across the internet, and despite being
as bots. different the activities of botnets are common.
This technique is applied to the real-world network traffic Signature based technique is one of the popular methods
which resulted in detection with high accuracy. The problem
for detecting the known attacks, like for those the pattern or
of this method lies in grouping of the botnets based on their signature are already identified and kept in the log file, so
interaction and some common behavior, where some botnets
this technique was limited within knowing known attacks
groups were misclassified because of its heterogeneous only. Later anomaly based detection technique was
property. introduced with the purpose of detecting unknown attacks
A P2P method for bot detection based on adaptive where Machine learning approach is used where initially a
multilayer feed forward neural network in cooperation with model is created and that model is trained to recognize all the
decision tree is proposed by Mohammad Alauthaman et al. activities of a system and network, the dataset that have been
[21]. The proposed method works on two fundamental used in different methods are different like for the PYAL
concepts. Firstly, it passively monitors network traffic technique TCP network traffic was analyzed , so this
secondly it utilizes the fact that during propagation phase bot technique was limited to TCP network traffic only as it could
shows frequent communication behaviors with its C&C botnet detect the attacks that have been done using other
server. protocol other than TCP, similarly the major drawback of
anomaly based detection technique lies in the use of such
To increase the performance of the framework they have
dataset to test the model in such approach, the evaluation of
used network traffic reduction approach. A payload
the network traffic also gets limited. Nature of the anomalies
independent, connection-based detection method is used, and
that keeps changing is another major challenge for the
the information is extracted from the TCP network traffic.
security personnel to combat the botnets activity. The need of
At the final approach, classification and decision tree is construction of realistic and comprehensive dataset is
used to select the important features to reduce the size and required for the evaluation of the network traffic in real time,
dimension of dataset and finally the P2P botnet are detected which do not limit under the use of one protocol so that
from the extracted dataset by differentiation the botnet traffic robustness and high performance can be ensured.
from legitimate traffic.

Published By:
Blue Eyes Intelligence Engineering
Retrieval Number: A1903058119 /19©BEIESP 2135 & Sciences Publication
 International Journal of Recent Technology and Engineering (IJRTE)
ISSN: 2277-3878, Volume-8, Issue-1, May 2019

Table 1. Summary of Botnets Detection Techniques

Author/Approach Techniques Research Gap

Ke Wang et al. [12]  Clustering  Focuses only on TCP network traffic,
 Learning phase  Unable to detect non-TCP based
 centroid model using
Mahalanobis distance
metric
Sajjad Arshad et al.  Anomaly based  Based on intuition that bots respond to command and
[18]  Net flow clustering perform malicious activities in a similar fashion
algorithm  But the trending botnets are structure independent
 Unable to detect botnets which refer to different
structure
 Efficiency of netflow clustering algorithm is low
Lee and Stolfo [13]  association rules  Restricted to area of application
 frequent episodes  Cannot be implemented to analyze botnet that targets
smart phone.
Hyunsang Choi et al.  BotGAD  Based on DNS traffic as a case study.
[17]  Limited to DNS traffic
 Unable to detect protocol and structure independent
botnets.
Wei Lu and Ali [14]  Auto Regression and  Low detection rate
Exogenous) model
 Intrusion detection.
A. Karasaridis, et al.  An anomaly based  Unable to detect protocol and structure independent
[19] passive analysis botnets.
algorithm  lacks real time botnet detection

Jing wang et. al. [20]  social interaction graphs  Grouping leads to misclassification of botnets
 Social correlation graph  Suffers false positive

Alauthaman et al. [21]  neural network  Considers only TCP traffic

 decision tree  Unable to detect botnets that used UDP traffic for
communication
G. Gu, J. Zhang, et al.  Anomaly-based  IRC and HTTP based C&C
[16] detection algorithms  Unable to detect protocol and structure independent
 botsniffer botnets.
 lacks real time botnet detection
Bhuyan et al. [15]  ANIDS  Most NIDSs depends on the environment.
 A system or method should be independent of the
environment.
 The nature of anomalies keeps changing over time
 Intruders adapt their network attacks to evade existing.
Pijush Barthakur [23]  Machine-learning  Based on theoretical backing
 Classification  Real-world data are difficult to extract
 Clustering  The nature of anomalies keeps changing over time
 May further result in false negative

Published By:
Blue Eyes Intelligence Engineering
Retrieval Number: A1903058119 /19©BEIESP 2136 & Sciences Publication
 Botnet Detection Techniques – An Analysis

18. Hyunsang Choi, Heejo Lee, and Hyogon Kim, BotGAD: Detecting Botnets
by Capturing Group Activities in Network Traffic
VI. CONCLUSION DOI10.1145/1621890.1621893
19. An anomaly-based botnet detection approach for identifying stealthy
In the recent years, the world has witnessed the massive botnets. Sajjad Arshad, Maghsoud Abbaspour ISBN: 978-1-4577-2058-1,
growth of internet traffic and this traffic is not always flooded DOI: 10.1109/ICCAIE.2011.6162198
20. Anestis Karasaridis, Brian Rexroad, David Hoeflin., Wide-scale botnet
by human activity, half of it is botnet activities. It has become
detection and characterization, 2007.
very important task for researchers and security personnel to 21. Jing wang, Ioannis ch paschalidis Botnet detection using social graph
combat these botnets activities. In the past year many analysis DOI: 10.1109/ALLERTON.2014.7028482 ,
techniques have been implemented to stop the vulnerability 22. Mohammad Alauthaman,, Nauman Aslam ,Li Zhang, Rafe Alasem,, M.
A. Hossain : A P2P Botnet detection scheme based on decision tree and
of botnets. A very important issue is differentiation of adaptive multilayer neural networks, Volume 29, Issue 11.
legitimate users and spammers, as such one technique IP 23. Sheharbano Khattak, Naurin Rasheed Ramay, Kamran Riaz Khan, Affan
blacklisting, many legitimate users were also blacklisted in A. Syed, and Syed Ali Khayam: A Taxonomy of Botnet Behavior,
Detection, and Defense DOI=[Link].7203
the process as the bot user and legitimate user may share a 24. Pijush Barthakur, Development of a Real-Time Machine-Learning based
common computer. The real challenge is to differentiate a bot Botnet Detection Mechanism, PhD Thesis, Sikkim Manipal University,
user and human and to detect the bot. Bot uses many evasion 2016
25. Salima Omar, Asri Ngadi, Hamid H. Jebur, Machine Learning Techniques
techniques to make their presence undetectable. Future scope for Anomaly Detection: An Overview, International Journal of Computer
in this area lies on creating a robust technique that does not Applications, Vol. 79 (2), 2013, ISSN: 0975–8887, pp. 33-41
limit evaluation of the network traffic on one protocol or use
of one dataset.
AUTHORS PROFILE
REFERENCES
Ms. Jwala Sharma is currently working as Assistant
1. Zhaosheng Zhu,Guohan Lu, Yan Chen, Zhi Judy Fu, Phil Robets, Keesook Professor in the Department of Information Technology,
Han, Botnets Research Survey, 2008 32nd Annual IEEE International DDE, Sikkim Manipal University. Her areas of interest
Computer Software and Applications Conference, DOI: include Computer Network & Security, Data Mining etc.
10.1109/COMPSAC.2008.205
2. Number of sent and received e-mails per day worldwide from 2017 to 2023
(in billions), URL:
[Link]
wide/ (accessed on 08/05/2019) Dr. Samarjeet Borah is currently working as
3. Meisam Eslahi, Rosli Salleh,Nor Bdrul anuar, Bots and Botnets, An Professor in the Department of Computer Applications,
overview of characteristics , detection and challenges,2012 IEEE SMIT, Sikkim Manipal University. His areas of interest
International conference on control system, computing and engineering. include Data Mining, Computer Security, NLP etc.
DOI:10.1109/Iccsce.2012.6487169
4. Somayeh Soltani, Seyed Amin Hosseini seno, Maryam Nezhadkamali and
Rahmat Budirato, A survey on Real world Botnets and detection
Mechanism, International Journal of Information & Network Security
(IJINS) Vol.3, No.2, April 2014, pp. 116~127 ISSN: 2089-3299
5. Wazir Zada Khan, Muhammad Khurran Khan, Fahad [Link] Muhaya,
Mohammed Y Aalsalem, A comprehensive Study of Email Spam Botnet
Detection, DOI:10.11.09/COMST.2015.2459015
6. Somayeh Soltani, Seyed Amin Hosseini Seno, Maryam Nezhadkamali and
Rahmat Budirato, A survey on real world botnets and detection
mechanisms, International Journal of Information & Network Security
(IJINS) Vol.3, No.2, April 2014, pp. 116~127 ISSN: 2089-3299
7. Bagel(computer worm) URL:
[Link]
8. An analysis of conficker's logic and rendezvous points URL:
[Link]
9. Storm worm DDOS attack
URL:[Link]
10. Top 5 Scariest Zombie Botnets
11. URL:[Link]
botnets/
12. Studying spamming botnets using Botlab
URL:[Link]
hn_html/
13. Ke Wang, Salvator J. Stolfo, Anamalous Payload-Based Network
Intrusion Detection, Conference: Recent Advances in Intrusion Detection:
7th International Symposium, RAID 2004, Sophia Antipolis, France,
September 15-17, 2004. Proceedings DOI:
10.1007/978-3-540-30143-1_11.
14. Wenkee Lee, Salvator J. Stolfo, Data Mining approaches for Intrusion
Detection DOI: 10.1109/SECPRI.1999.766909 ISSN: 1081-6011
15. Wei Lu, Ali A. Ghorbani, Mahbod Tavallee, detecting network anomalies
using different Wavlet Basis Functions, communication networks and
service research conferences ,2008, DOI:10.1109/CNSR.2008.75
16. Guofei Monowar H. Bhuyan, D. K. Bhattacharyya, and J. K. Kalita,
Network anomaly detection, methods Systems and Tools, IEEE
Communications Surveys & Tutorials, Vol. 16, No. 1, First Quarter 2014
ISSN: 1553-877X DOI: 10.1109/SURV.2013.052213.00046
17. Gu ,Junjie Zhang BotSniffer: Detecting Botnet Command and Control
Channels in Network Traffic 2008

Published By:
Blue Eyes Intelligence Engineering
Retrieval Number: A1903058119 /19©BEIESP 2137 & Sciences Publication