Incollection
Peer-to-Peer Botnet Investigation: A Review
Mark Scanlon; M-Tahar Kechadi. Proceedings of the 6th International Symposium on Digital Forensics and Information Security (DFIS-2012), Future Information Technology, Application, and Service, pp. 231-238, 2012.
Contribution Summary
This paper provides a comprehensive review of the current state of Peer-to-Peer (P2P) botnet investigation, highlighting the challenges and obstacles faced by investigators. The authors discuss the evolution of botnet design from traditional client/server to decentralized P2P networks, which has made it more difficult to investigate and take down these networks. The paper outlines three main approaches to P2P botnet investigation: deliberately infecting a host and participating in the botnet, deliberately infecting a virtual host, and creating a crawler to mimic the botnet protocol. The authors also present case studies of the Nugache, Storm, and Waledec botnets, highlighting their design and operation. The paper concludes by emphasizing the need for a combination of research, network monitoring, deep packet inspection, and network crawling to successfully investigate P2P botnets.
Keywords: Peer-to-Peer botnets; Botnet investigation; Decentralized networks; Cybersecurity; Digital forensics; Botnet design; P2P protocols; Botnet takedown
Abstract
Botnets have become the tool of choice to conduct a number of online attacks, e.g., distributed denial of service (DDoS), malware distribution, email spamming, phishing, advertisement click fraud, brute-force password attacks, etc. Criminals involved in conducting their craft online all share one common goal; not to get caught. Botnet design, as a result, has moved away from the traditional, more traceable and easily blocked client/server paradigm towards a decentralized Peer-to-Peer (P2P) based communication system. P2P Internet communication technologies lend themselves well to be used in the world of botnet propagation and control due to the level of anonymity they award to the botmaster. For the cybercrime investigator, identifying the perpetrator of these P2P controlled crimes has become significantly more difficult. This paper outlines the state-of-the-art in P2P botnet investigation.
BibTeX
@incollection{scanlon2012p2pbotnetreview,
title="{Peer-to-Peer Botnet Investigation: A Review}",
author={Scanlon, Mark and Kechadi, M-Tahar},
booktitle={Proceedings of the 6th International Symposium on Digital Forensics and Information Security (DFIS-2012), Future Information Technology, Application, and Service},
pages="231-238",
month=09,
year=2012,
address={Vancouver, Canada},
publisher={Springer},
doi={10.1007/978-94-007-5064-7_33},
}