Offense Questions: Botnet detection

1
Offense Questions Botnet detection

• What is the difference b/t bot and pure worms
• CC ?
• Can we automatically detect CC ? How?
• No real invariants/separator in CC traffic ?
• Even IRC-based detection seems hopeless in the
  paper
• Maybe also consider semantics, not just numerical
  values, like traffic size, length of packets,
  etc.
• Fundamental difference human vs. machine !
• What about URL-based botnet?

2
Offense Questions Botnet detection II

• Detection based on specific bot commands ?
• Specific bot dependent
• Can be encrypted
• Statistical finger printing techniques ?
• Contradict w/ the U Michigan paper