@inproceedings{a7987337b9cb46fb8c288937a08c4387,
title = "BotTracer: Execution-based bot-like malware detection",
abstract = "Bot-like malware has posed an immense threat to computer security. Bot detection is still a challenging task since bot developers are continuously adopting advanced techniques to make bots more stealthy. A typical bot exhibits three invariant features along its onset: (1) the startup of a bot is automatic without requiring any user actions; (2) a bot must establish a command and control channel with its botmaster; and (3) a bot will perform local or remote attacks sooner or later. These invariants indicate three indispensable phases (startup, preparation, and attack) for a bot attack. In this paper, we propose BotTracer to detect these three phases with the assistance of virtual machine techniques. To validate BotTracer, we implement a prototype of BotTracer based on VMware and Windows XP Professional. The results show that BotTracer has successfully detected all the bots in the experiments without any false negatives.",
keywords = "Botnet, Malware detection, Virtual machine",
author = "Lei Liu and Songqing Chen and Guanhua Yan and Zhao Zhang",
year = "2008",
doi = "10.1007/978-3-540-85886-7\_7",
language = "English",
isbn = "3540858849",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
pages = "97--113",
booktitle = "Information Security - 11th International Conference, ISC 2008, Proceedings",
note = "11th International Conference on Information Security, ISC 2008 ; Conference date: 15-09-2008 Through 18-09-2008",
}