An in-depth understanding of botnet behavior is a precursor to building effective defenses against this serious and growing threat. In this paper we describe our initial steps toward building a flexible and scalable laboratory testbed for experiments with bots and botnets. Our Botnet Evaluation Environment (BEE) is designed to enable individual bots or networks of up to thousands of bots to be ...

Botnets have traditionally used centralized architectures for command and control. In such architectures, a relatively small number of centralized servers is used to command the bots. Centralized botnet architectures are straightforward to deploy, but relatively easy to take down by disabling the command and control servers. In an effort to increase the resilience of their botnets, malware crea...

We formalize the problem of detecting presence a botnet in network as hypothesis testing where we observe single instance graph. The null hypothesis, corresponding to absence botnet, is modeled random geometric graph every vertex assigned location on $d$-dimensional torus and two vertices are connected when their distance smaller than certain threshold. alternative similar, except that there sm...

The Command and Control communication of a botnet is evolving into sophisticated covert communication. Techniques as encryption, steganography, and recently the use of social network websites as a proxy, impede conventional detection of botnet communication. In this paper we propose detection of covert communication by passive hostexternal analysis of causal relationships between traffic flows ...

Nowadays, with increasing number of Internet users and its commercial character subsequently bring in proportionate number of criminal minded network security threats. Among various of malicious programs, the botnet is considered as one of the most critical issue for the current worldwide Internet users. Unfortunately, existing techniques for detecting botnetsespecially cross-site scripting (XS...