A Study of Botnets: Systemization of Knowledge and Correlation-based Detection

Botnets have been the cause of some of the gravest cyberthreats in recent times. Despite research and commercial efforts to curb botnets, they continue to grow in size and sophistication. As a response to this persistent yet rapidly-evolving threat, hundreds of scientific reports have been published on botnet architectures, economics, detection, defense and future trends. Resultantly, attackers have become more aggressive by using robust communication mechanisms, decentralized architecture and a number of elaborate evasion techniques. An obvious by-product of this perennial arms race is that the field of botnets has grown quite complex. This complexity is two-fold. Firstly, the vast body of literature on botnets remains largely unstructured. Secondly, a collaborative platform to carry out botnet research is sorely missing. In this thesis, we address the issues identified above by first structuring the knowledge in the area of botnets, and then developing a botnet detection tool. We present three taxonomies related to botnet behaviors/architectures, detection mechanisms, and defense strategies. We assert that our proposed taxonomies aid in visualizing the diversity in botnet research, and in making informed decisions when devising new detection and defense mechanisms. Next, we present BotFlex — an open-source, extensible, tool for botnet detection. We use BotFlex to analyze hundreds of GBs of a home ISP’s traffic, with ground truth provided by a commercial security company. We observe true and false positive rates of 89.6% and 28.6%, respectively. These are very positive results for a system currently using a handful of features and decisions elements from existing literature. We run BotHunter, a closed-source bot detection tool, over the same data set and observe similar detection rates and performance, validating our implementation against the only freely available tool.