Skip to main navigation Skip to search Skip to main content

BotTracer: Execution-based bot-like malware detection

  • George Mason University
  • Iowa State University

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

55 Scopus citations

Abstract

Bot-like malware has posed an immense threat to computer security. Bot detection is still a challenging task since bot developers are continuously adopting advanced techniques to make bots more stealthy. A typical bot exhibits three invariant features along its onset: (1) the startup of a bot is automatic without requiring any user actions; (2) a bot must establish a command and control channel with its botmaster; and (3) a bot will perform local or remote attacks sooner or later. These invariants indicate three indispensable phases (startup, preparation, and attack) for a bot attack. In this paper, we propose BotTracer to detect these three phases with the assistance of virtual machine techniques. To validate BotTracer, we implement a prototype of BotTracer based on VMware and Windows XP Professional. The results show that BotTracer has successfully detected all the bots in the experiments without any false negatives.

Original languageEnglish
Title of host publicationInformation Security - 11th International Conference, ISC 2008, Proceedings
Pages97-113
Number of pages17
DOIs
StatePublished - 2008
Event11th International Conference on Information Security, ISC 2008 - Taipei, Taiwan, Province of China
Duration: Sep 15 2008Sep 18 2008

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume5222 LNCS

Conference

Conference11th International Conference on Information Security, ISC 2008
Country/TerritoryTaiwan, Province of China
CityTaipei
Period09/15/0809/18/08

Keywords

  • Botnet
  • Malware detection
  • Virtual machine

Fingerprint

Dive into the research topics of 'BotTracer: Execution-based bot-like malware detection'. Together they form a unique fingerprint.

Cite this