Forensic Analysis of a Botnet System: Architecture and Capabilities
type: CreativeWork
description: The botnet is one of the biggest threats to computer machines and systems. The main challenge of the botnet is that this type of malware has developed to avoid detection. Many of the computer users use anti-virus tools that do not detect the botnet existence in the computer system. The botnet infects a computer then connects the computer to the command and control server to join. The botnet runs in the background and communicates with the (C&C) server to receive instruction that typically involves being part of malicious activities performed against other organisations. The malicious activities typically performed without the knowledge of the owner of the computer machine is being part of the malicious activities. The victims of the botnet are usually in the millions of infected hosts. A secure laboratory environment made this research to be able to examine actions close to a real botnet event. The Dionaea honeypot used to be able to collect the samples of the malware including the botnet samples. Then, the downloaded botnet samples submitted into two external sandbox services to be able to analyse the samples. After that, the samples were analysed by a malware analysis tool to be able to have a clear picture of the botnet malware samples. In addition, the downloaded botnet samples by Dionaea then used to infect the Virtual machine (VM) host in the experiment. Each botnet sample used to infect the host, then, the host formatted to its original status for fresh infects on with other bots downloaded by Dionaea. The focus of this research is to be able to find the possible evidence in the infected host as well as the communication of the host with the C&C server. The findings from the laboratory experiment show evidence that related to a botnet event. The research was able to locate the evidence of the existence of the botnet in the infected host in the registry, file system, network and the physical memory of the infected host. The research found that there were a lar…
abstract: The botnet is one of the biggest threats to computer machines and systems. The main challenge of the botnet is that this type of malware has developed to avoid detection. Many of the computer users use anti-virus tools that do not detect the botnet existence in the computer system. The botnet infects a computer then connects the computer to the command and control server to join. The botnet runs in the background and communicates with the (C&C) server to receive instruction that typically involves being part of malicious activities performed against other organisations. The malicious activities typically performed without the knowledge of the owner of the computer machine is being part of the malicious activities. The victims of the botnet are usually in the millions of infected hosts. A secure laboratory environment made this research to be able to examine actions close to a real botnet event. The Dionaea honeypot used to be able to collect the samples of the malware including the botnet samples. Then, the downloaded botnet samples submitted into two external sandbox services to be able to analyse the samples. After that, the samples were analysed by a malware analysis tool to be able to have a clear picture of the botnet malware samples. In addition, the downloaded botnet samples by Dionaea then used to infect the Virtual machine (VM) host in the experiment. Each botnet sample used to infect the host, then, the host formatted to its original status for fresh infects on with other bots downloaded by Dionaea. The focus of this research is to be able to find the possible evidence in the infected host as well as the communication of the host with the C&C server. The findings from the laboratory experiment show evidence that related to a botnet event. The research was able to locate the evidence of the existence of the botnet in the infected host in the registry, file system, network and the physical memory of the infected host. The research found that there were a lar…
author: Almutairi, Sultan
keywords: Botnet, Botnet communications, Botnet architecture and capabilities, Botnet analysis, IRC bot
date published: 2014
date modified: 2026-07-27T18:46:26Z
provider: AUT University
publisher: Networked Digital Library of Theses and Dissertations
type: WebPage
source organization: AUT University