Design of Generic Framework for Botnet Detection in Network Forensics

TL;DR

This paper proposes a generalized framework for botnet detection in network forensics, aiming to unify various existing methods and provide a guideline for researchers to develop their own detection techniques.

Contribution

It introduces a novel, generic model for botnet detection, based on analyzing commonalities among existing methods and representing the framework with UML diagrams.

Findings

Identified common features of existing botnet detection methods

Developed a UML-based generalized detection framework

Provides methodology and guidelines for future research

Abstract

With the raise in practice of Internet, in social, personal, commercial and other aspects of life, the cybercrime is as well escalating at an alarming rate. Such usage of Internet in diversified areas also augmented the illegal activities, which in turn, bids many network attacks and threats. Network forensics is used to detect the network attacks. This can be viewed as the extension of network security. It is the technology, which detects and also suggests prevention of the various network attacks. Botnet is one of the most common attacks and is regarded as a network of hacked computers. It captures the network packet, store it and then analyze and correlate to find the source of attack. Various methods based on this approach for botnet detection are in literature, but a generalized method is lacking. So, there is a requirement to design a generic framework that can be used by any botnet detection. This framework is of use for researchers, in the development of their own method of botnet detection, by means of providing methodology and guidelines. In this paper, various prevalent methods of botnet detection are studied, commonalities among them are established and then a generalized model for the detection of botnet is proposed. The proposed framework is described as UML diagrams.