Real-Time Botnet Command and Control Characterization at the Host Level JHEN-HUANG Gao

 Title:  Real-Time Botnet Command and Control Characterization at the Host Level  Author & Institution :  Farhood Farid Etemad  Payam Vahdani  Publication:  6'th International Symposium on Telecommunications  Year: 2012  Cited (Google): 0 Basic Information 1/7

 Introduction  Architecture  Detect bot  Real – Time Filtering  Conclusion Outline 2/7

 Botnet 、 other kind of malwares  C&C is centralized or decentralized  Botnet can cause many problem  Normal solution Introduction 3/7

 IRC protocol string  NICK 、 PASS 、 USER 、 JOIN 、 PRVIMSG 、 OPER 、 MOTD  ex Get me the file “website.html” ClientSever “Here is the file” followed by the file’s content  HTTP protocol  GET 、 POST 、 HEAD Architecture 4/7

 IRC PART  Td>Tdh ： normal IRC  Td<Tdh ： malicious IRC  HTTP PART Detect bot 5/7

 Filtering malicious traffic after detection Real – Time Filtering 6/7

 Real-time‘s method :  Advantage  Find bot immediately  Simple to use  Weakness  Can’t be use on decentralized Conclusion 7/7

THANK YOU