Inevitable Battle Against Botnets

Introduction

When it comes to talk about cyber security and its possible consequences, botnet is one of the most common word that pops in people’s mind who are specialised in cybersecurity. Botnets can be considered as network of bots as they consist of more than one bot working together. Botnets use command and control (C&C) communication channels to talk with the cybercriminal who controls them. During this communication process, bots receive commands from the cybercriminal and then report back to that cybercriminal. This is one of the most distinctive characteristics of botnets which separates them from other malwares. Botnets have different architectures and cybercriminals choose any of these architectures depending on their purposes. Cybercriminals have a range of different options ranging from client-server model to peer-to-peer networks (Botnet, 2018). In general, botmasters try to collect more devices as possible to increase the strength of botnet. Through infection process, botmasters add new devices to their army. Botmasters infect new devices by using viruses, worms, trojan horses and many other malicious techniques. Once a device gets infected by any of the mentioned malicious technique, it becomes a part of the botnet and can be labelled as a bot. Bots can be any device as long as cybercriminals can infect them such as computers and smartphones. On the other hand, it is well known that botnet detection is an on-going problem. It is very challenging to detect botnets as they use small amounts of computing power and they can update their behaviours. They can be very dangerous as they are capable of carrying out distributed denial-of-service (DDoS) attacks, stealing sensitive data and performing a number of different malicious behaviours. They can cause a range of different and serious problems if they are not successfully detected and neutralized. To be more precise, leakage of sensitive data can lead to conflicts at different levels. If cybercriminals leak government secrets, this can cause a crisis at a national level. On the other hand, DDoS attacks can make important online services unavailable. For example, if cybercriminals decide to perform DDoS attacks on online banking system, this can lead to money transaction problems, money fraud and even more serious financial issues. These are only some of the few problems that botnets can cause. Therefore, it is important to detect and understand botnets. This chapter aims to increase the knowledge about botnets by giving information about different types of botnets with their uses and formation. Also, it aims to explain botnet’s working principles, architecture, life-cycle, possible threats, infection and detection processes.