What is the Pattern of a Botnet?

As complex, flexible and efficient platforms for network attacks, botnets are considered as one of the most serious threats to current Internet security. The evolution and diversification of botnets call for a clear and fine grained taxonomy, but existing taxonomies are either incomplete or overlapping. In order to classify botnets accurately, we propose a concept called control structure to exactly and uniformly describe how botnets are controlled by botmasters. From the point of control structure, we classify botnets into certain patterns. Our taxonomy not only helps to understand botnets better, but also is useful for defenders when considering how to take down a botnet. Further, through comparison between different patterns, we predict that the P pattern and F-(O, P) pattern would be the most important trends for botnets, and the F layer would less likely appear without a P layer.