Botnet: Variants, Architecture, Operations, Threats and Mitigation Techniques

BOTNET 0
Botnet

BOTNET 1
Table of Contents
Introduction................................................................................................................ 2
Variants of Botnet....................................................................................................... 2
IRC botnet............................................................................................................... 3
P2P botnet............................................................................................................... 3
HTTP botnet............................................................................................................. 4
Botnet architecture.................................................................................................... 4
Centralized C&C Topology....................................................................................... 4
Multi-server C&C topology....................................................................................... 4
Hierarchical C&C topology....................................................................................... 5
P2P topology........................................................................................................... 5
Operations and communications of a botnet..............................................................6
Potential threats posed by a botnet........................................................................... 6
DDOS attack............................................................................................................ 7
Spamming............................................................................................................... 7
Phishing attack........................................................................................................ 7
Mitigation tools and techniques.................................................................................. 7
Networked applications targeted by Botnet...............................................................8
Email programs....................................................................................................... 8
HTTP protocols........................................................................................................ 8
File transfer protocol............................................................................................... 8
Summary/Conclusion.................................................................................................. 8
References............................................................................................................... 10

BOTNET 2
Introduction
The term botnet is defined as a collection of internet-linked devices that may
contain computer servers, networks and devices which are mainly handled by a
common kind of malware. In such kind of process, infected systems and networks
are controlled by threat actors using remote control systems and devices. In this
generation, the botnet has become one of the largest threats to security systems
[1]. This type of process helps the hackers for performing malicious activities in the
workplace and able to collect reliable data of the consumers. The goal of this
investigation is to examine the variants of the botnet and identify potential threats
posed by a botnet. It is identified that botnet negatively impact on the society
where the hackers send an unwanted signal to the user’s networks and access their
personal details which may lead financial and ethical issues in the society. This
proposed study will cover numerous sections including variants of a botnet, botnet
architecture, operations, potential threats, mitigation techniques and networked
applications targeted by a botnet.
Variants of Botnet
It is identified that there are major three variants of botnet process including IRC,
HTTP and P2P botnet that provide a way for performing malicious activities in the
companies. The below figure shows taxonomy of botnet which describes the various
kinds of botnet threats faced by the companies:

BOTNET 3
IRC botnet
IRC is defined as internet relay chat which involves communication channels and
networks in order to control and manage the servers used by the companies.
Generally, such kind of botnet can be utilized for monitoring malware interventions
into the IRC networks and channels and perform automation process in the system.
It is the first variant of the botnet process which is used for demolition activities. A
recent study argued that based on the signals received from the IRC network,
individual bots perform the malware activities and transfer the unauthentic signals
to the main server [2].
P2P botnet
It is defined as peer to peer botnet which may be formed using the P2P networks
and protocols. It is very complex for companies and users to address such kind of
botnet threat because of their decentralized structure and framework where every
P2P bot may act as the server and client. In which the hackers send the signals with