Peer-to-Peer Dynamics of Zeus Botnets: Challenges and Solutions

Zeus malware has been a significant threat in the realm of cybercrime, primarily known for its role in phishing schemes and deploying ransomware like CryptoLocker. This literature review delves into multiple facets of Zeus malware: from detection techniques to its specific attack methods such as man-in-the-browser on internet banking platforms. The analysis spans across different systems including Android, highlighting the unique challenges these platforms face due to Zeus. Additionally, the review explores the evolution and resilience of peer-to-peer botnets associated with Zeus, emphasizing how modern cybersecurity measures can detect and neutralize these threats effectively.

Running head: LITERATURE REVIEW ON ZEUS MALWARE
Literature Review on Zeus Malware
Name of the Student
Name of the University
Author’s Note:

1
LITERATURE REVIEW ON ZEUS MALWARE
Literature Review on Zeus Malware
Zeus or Zbot is a specific malware package of Trojan horse, which eventually runs on
every version of the Microsoft Windows operating system. Several criminal activities and
malicious tasks are easily carried out with the help of this particular malware package. Any
information related to banking can be stolen with the help of Zeus malware by activities like
form grabbing, man in the browser attacks and keystroke logging. The installation of
CryptoLocker ransomware is done by this particular malware. This Zeus malware is spread
mainly by phishing schemes. Following are the six literature reviews on Zeus malware that
would help in understanding the malware in details.
1. DETECTION OF THE ZEUS BOTNET MALWARE
According to the journal, the increased and remarkable Internet evolution that has
occurred subsequently after the perfect development of any high commonness of smart
phones, systems and the constant utilization of Internet on huge amount in everyday’s life has
eventually lead to all types of network attacks. E-commerce websites are the most utilized
websites on Internet; therefore, the attacks on these websites are extremely common.
Currently, it is observed that the hackers have started using botnets for the achievement of
their objectives. Zeus botnet is considered as one of the most dangerous botnets for hacking
any kind of banking information. HBD or simply Host Botnet Detection Software is
implemented for the detection of Zeus botnet in any system [1].
2. MAN IN THE BROWSER ATTACKS: A FORM OF ZEUS MALWARE ATTACKS
This journal paper focuses on the specific technique of the attacks of Zeus malware.
Man in the browser attacks are the most significant techniques for Zeus attacks. This type of
attack mainly targets on those customers, who are using Internet banking. Although various
security measures are undertaken for securing the Internet banking, still the Zeus botnet can

2
LITERATURE REVIEW ON ZEUS MALWARE
easily track the details of the users, who are using Internet banking. The man in the browser
attacks are an integrated version of man in the middle attacks, and complete its task by
simply changing the details of legal transactions and authenticated data for the advantage of
the hackers. There are several relevant strategies for controlling the man in the browser
attacks [2].
3. DETECTION OF ZEUS BY CRONUS
According to this journal, the detection of the Zeus malware can be done by various
techniques. Cronus is an Intrusion Detection System or IDS, which eventually targets the
Zeus malware package. This Cronus system is implemented as an experiment on a specific
production network for detecting any type of Zeus malware. It provides efficiency and
effectiveness in the performance of the network by detecting and preventing any malware.
Thus, the network of any banking sector is extremely safe with the implementation of Cronus
system [3].
4. ANALYSIS OF ZEUS MALWARE IN ANDROID PLATFORMS
Smart phones are most utilized mobiles that have every feature and function of a
system. The access to Internet in the smart phones has opened the doors for all types of
mobile malware. This is specifically common for the android platforms. The Android
platforms are characterized or systemized in such a way, that they can detect and prevent
Zeus malware within it. This Zeus malware always targets those android platforms that are
dealing with Internet banking. The characterization of malware is done from the installation
and activation to the specific malicious payloads. The three major techniques for the
characterization of malware include repacking, drive by download and update attacks [4].

3
LITERATURE REVIEW ON ZEUS MALWARE
5. PEER-TO-PEER ZEUS BOTNETS
Zeus malware was first detected in the year 2007 as a specific sub category of Trojans
that is responsible for the hacking of credentials. The two variants of this particular malware
are detected on the basis of command servers that are eventually centralized. The command
servers are regularly tracked and even blocked for security purposes. The second version of
this malware was detected into the variant of peer-to-peer in the year 2011. The peer-to-peer
version is extremely difficult to stop. This version majorly serves two purposes, which
include the exchange of configuration and binary updates amongst each other by bots and the
exchange of proxy bots for retrieving the commands as well as dropping the hacked data [5].
6. CLASSIFICATION OF ZEUS MALWARE BY SYSTEM EVENT ORDERING
The Zeus malware and its subsequent family can be easily identified by a good
technique, known as the runtime execution artefacts. However, this above-mentioned
technique is extremely expensive and cannot be afforded by all. CHATTER is a typical
system, which only concerns with the order in which the events of a high level system occur.
Mapping of the individual events are done on a particular alphabet and the traces of execution
are eventually captured through various terse concatenations. This classifies the Zeus
malware systematically [6].

4
LITERATURE REVIEW ON ZEUS MALWARE
REFERENCES
[1] Ibrahim, Laheeb Mohammed, and Karam H. Thanon. "Analysis and detection of the zeus
botnet crimeware." International Journal of Computer Science and Information Security 13,
no. 9 (2015): 121.
[2] Dougan, Timothy, and Kevin Curran. "Man in the browser attacks." International Journal
of Ambient Computing and Intelligence (IJACI) 4, no. 1 (2012): 29-39.
[3] Riccardi, Marco, Roberto Di Pietro, Marta Palanques, and Jorge Aguila Vila. "Titans’
revenge: Detecting Zeus via its own flaws." Computer Networks 57, no. 2 (2013): 422-435.
[4] Zhou, Yajin, and Xuxian Jiang. "Dissecting android malware: Characterization and
evolution." In Security and Privacy (SP), 2012 IEEE Symposium on, pp. 95-109. IEEE, 2012.
[5] Andriesse, Dennis, Christian Rossow, Brett Stone-Gross, Daniel Plohmann, and Herbert
Bos. "Highly resilient peer-to-peer botnets are here: An analysis of gameover zeus."
In Malicious and Unwanted Software:" The Americas"(MALWARE), 2013 8th International
Conference on, pp. 116-123. IEEE, 2013.
[6] Mohaisen, Aziz, Andrew G. West, Allison Mankin, and Omar Alrawi. "Chatter:
Classifying malware families using system event ordering." In Communications and Network
Security (CNS), 2014 IEEE Conference on, pp. 283-291. IEEE, 2014.