Nepenthes Honeypots based Botnet Detection
This addresses the challenge of detecting botnet attacks for network security, but it is incremental as it applies existing honeypot methods to botnet detection.
The paper tackles botnet detection by deploying Nepenthes honeypots in private and public networks, using an automated framework for malware collection and analysis with anti-virus scans, and reports experimental results showing detection of known bots.
The numbers of the botnet attacks are increasing day by day and the detection of botnet spreading in the network has become very challenging. Bots are having specific characteristics in comparison of normal malware as they are controlled by the remote master server and usually dont show their behavior like normal malware until they dont receive any command from their master server. Most of time bot malware are inactive, hence it is very difficult to detect. Further the detection or tracking of the network of theses bots requires an infrastructure that should be able to collect the data from a diverse range of data sources and correlate the data to bring the bigger picture in view. In this paper, we are sharing our experience of botnet detection in the private network as well as in public zone by deploying the nepenthes honeypots. The automated framework for malware collection using nepenthes and analysis using anti-virus scan are discussed. The experimental results of botnet detection by enabling nepenthes honeypots in network are shown. Also we saw that existing known bots in our network can be detected.