A Framework for Botnet Infection Determination through Multiple Mechanisms Applied on Honeynet Data

Botnets are a class of internet attacks having different characteristics as compared to the normal internet attacks. One of the features that uniquely characterize a botnet attack is that "the infected machine (Bot) is being remotely controlled by an entity called "Botmaster". The Botmaster remotely controls these infected systems through "Command and Control" servers (C&C). Over a period of time complexity of botnets has increased many folds. Advance techniques employed by botnets such as protocol encryption, complex botnet structure and multi stage infection propagation models have made the botnets detection a challenging problem. Hence there is a need of a botnet detection mechanism which is independent of C&C protocol, structure and the infection propagation model used by the botnet. In the work presented in this paper, the experiments have been performed for evaluating the strength of existing botnet detection techniques, and proposed an advance detection mechanism which uses a logical combination of existing open source solutions with Honeynet technologies and our own mechanisms for botnets detection. A test setup as a proof-of-concept of the proposed framework with the experimental results is presented in this paper.