This is why BotHunter was created. From the labs of SRI International, the Army Research Office and the National Science Foundation, BotHunter works to discover stealth botnet activity on the network. BotHunter attempts to uncover compromised machines by gathering information from numerous sensors around the world looking for the telltale signatures of bot activity.
BotHunter uses specialized malware packet sensors, which look for scanning, exploit patterns, code downloading, bot coordination communications and outbound attack launches. By comparing these known botnet traffic patterns to the traffic flows within the trusted network, it can alert users when it detects suspicious botnet activity.
BotHunter differs from traditional IDS in its methods of detecting activity through "infection-dialog-based" activity: the command and control communication patterns used by botnets. Although nothing triggers the antivirus, BotHunter notices when a computer is attempting to contact several email servers and UDP traffic is going to several computers, such as those known to belong to a Russian criminal network that is being monitored by BotHunter. BotHunter uses this information to assign a score to events; the display console logs the forensic evidence, listing the infected machines, botnet control servers, malicious code-download servers and details about outbound scanning that newly infected machines may be performing.
BotHunter is one of a few tools that can help discover operating botnets within a network. Its distributed intelligence model and the ease of operation should get it into more hands, which will aid its usefulness in detecting and combating the vast array of cybercriminal enterprises plaguing the Internet.
About the author:
Scott Sidel is an ISSO with Lockheed Martin.
This was first published in December 2008