This paper presents a threat to cyber resilience in the form of a conceptual model of a malware rebirthing botnet which can be used in a variety of scenarios. It can be used to collect existing malware and rebirth it with new functionality and signatures that will avoid detection by AV software and hinder analysis. The botnet can then use the customized malware to target an organization with an...

In this paper, we analyze a large amount of infection data for three major botnets: Conficker, MegaD, and Srizbi. These botnets represent two distinct types of botnets in terms of the methods they use to recruit new victims. We propose the use of cross-analysis between these different types of botnets as well as between botnets of the same type in order to gain insights into the nature of their...

In recent years, a large number of Internet Things devices are used in life, many which vulnerable to attacks from security perspective. Botnet malware is one the main threats IoT devices. Hence detection botnet most important challenge for This paper proposes an approach base on PSI graph data combine with evolutionary algorithm-based technique. To best our knowledge, there have been no studie...

Remote-controlled malware, organized in so-called botnets, have emerged as one of the most prolific kinds of malicious software. Although numbers vary, in extreme cases such as Conficker, Bredolab and Mariposa, one botnet can span up to several million infected computers. This way, attackers draw substantial revenue by monetizing their bot-infected computers. This thesis encapsulates research o...

Nowadays, botnets are considered as essential tools for planning serious cyberattacks. Botnets are used to perform various malicious activities such as DDoSattacks and sending spam emails. Different approaches are presented to detectbotnets; however most of them may be ineffective when there are only a fewinfected hosts in monitored network, as they rely on similarity in...

Botnets allow malefactors manage millions of infected computers simultaneously and provide large-scale successful attacks. The paper suggests an approach for multi-agent simulation of botnets and botnet protection mechanisms. The main contribution of the paper is an improved simulation environment for agent based simulation of botnets and experimentation with this environment for analysis of di...

The networks of compromised and remotely controlled computers (bots) are widely used in many Internet fraudulent activities, especially in the distributed denial of service attacks. Brute force gives enormous power to bot masters and makes botnet traffic visible; therefore, some countermeasures might be applied at early stages. Our study focuses on detecting botnet propagation via public websit...

We develop new techniques to map botnet membership using traces of spam email. To group bots into botnets we look for multiple bots participating in the same spam email campaign. We have applied our technique against a trace of spam email from Hotmail Web mail services. In this trace, we have successfully identified hundreds of botnets. We present new findings about botnet sizes and behavior wh...

We consider the problem of using flow-level data for detection of botnet command and control (C&C) activity. We find that current approaches do not consider timingbased calibration of the C&C traffic traces prior to using this traffic to salt a background traffic trace. Thus, timing-based features of the C&C traffic may be artificially distinctive, potentially leading to (unrealistically) optim...