# Peer-to-Peer Botnet Investigation: A Review

Canonical URL: https://markscanlon.co/publications/P2PBotnetInvestigationAReview

CSL-JSON: https://markscanlon.co/publications/P2PBotnetInvestigationAReview.csl.json
BibTeX: https://markscanlon.co/publications/P2PBotnetInvestigationAReview.bib
RIS: https://markscanlon.co/publications/P2PBotnetInvestigationAReview.ris

Authors: Mark Scanlon; M-Tahar Kechadi
Venue: Proceedings of the 6th International Symposium on Digital Forensics and Information Security (DFIS-2012), Future Information Technology, Application, and Service
Year: 2012
DOI: https://doi.org/10.1007/978-94-007-5064-7_33
PDF: https://markscanlon.co/publications/P2PBotnetInvestigationAReview.pdf
Full text: https://markscanlon.co/publications/P2PBotnetInvestigationAReview.full.md

## Contribution Summary

This paper provides a comprehensive review of the current state of Peer-to-Peer (P2P) botnet investigation, highlighting the challenges and obstacles faced by investigators. The authors discuss the evolution of botnet design from traditional client/server to decentralized P2P networks, which has made it more difficult to investigate and take down these networks. The paper outlines three main approaches to P2P botnet investigation: deliberately infecting a host and participating in the botnet, deliberately infecting a virtual host, and creating a crawler to mimic the botnet protocol. The authors also present case studies of the Nugache, Storm, and Waledec botnets, highlighting their design and operation. The paper concludes by emphasizing the need for a combination of research, network monitoring, deep packet inspection, and network crawling to successfully investigate P2P botnets.

## Abstract

Botnets have become the tool of choice to conduct a number of online attacks, e.g., distributed denial of service (DDoS), malware distribution, email spamming, phishing, advertisement click fraud, brute-force password attacks, etc. Criminals involved in conducting their craft online all share one common goal; not to get caught. Botnet design, as a result, has moved away from the traditional, more traceable and easily blocked client/server paradigm towards a decentralized Peer-to-Peer (P2P) based communication system. P2P Internet communication technologies lend themselves well to be used in the world of botnet propagation and control due to the level of anonymity they award to the botmaster. For the cybercrime investigator, identifying the perpetrator of these P2P controlled crimes has become significantly more difficult. This paper outlines the state-of-the-art in P2P botnet investigation.