Taxonomy A. IRC-based botnets Client-server model
{"Image DocumentName": "Taxonomy A. IRC-based botnets Client-server model", "Image ImageDescription": "(Liu et al, 2009) (Zhu et al, 2006) A. IRC-based botnets. Client-server model. Centralized architecture. Agobot (2002), SDBot (2002), SpyBot (2003), GT bot (2004)       Fast-flux. Botnets make agile use of short-lived domains to evasively move their command-and-control (C&C) infrastructure. Fast-flux networks rapidly change DNS records to evade blacklists and resist take downs [25]. In an attempt to evade domain name blacklisting, attackers now make very aggressive use of DNS agility. The most common example of an agile malicious resource is a fast-flux network, but DNS agility takes many other forms including disposable domains (e.g., tens of thousands of randomly generated domain names used for spam or botnet C&C), domains with dozens of A records or NS records (in excess of levels recommended by RFCs, in order to resist takedowns), or domains used for only a few hours of a botnet\u2019s lifetime. Perhaps the best example is the Conficker. C worm [15]. After Conficker.C infects a machine, it will try to contact its C&C server, chosen at random from a list of 50,000 possible domain names created every day. Clearly, the goal of Conficker.C was to frustrate blacklist maintenance and takedown efforts. Other malware that abuse DNS include. Sinowal (a.k.a. Torpig) [9], Kraken [20], and Srizbi [22]. The aggressive use of newly registered domain names is seen in other contexts, such as spam campaigns and malicious flux networks [25, 19]. This strategy delays takedowns, degrades the effectiveness of blacklists, and pollutes the Internet\u2019s name. space with unwanted, discarded domains.     B. Peer-to-Peer botnets. Decentralized architecture. More difficult to detect. No central server to shut down. C. Other. HTTP-based (Rustock, Blackenergy, Conficker,\u2026 ) DNS-based (Fast-flux)     Slaper (2002) Sinit (2003) (PKC for update auth) Phatbot (2004), Storm worm (2007) Conficker E (2009)    ,", "Image XResolution": "37", "Image YResolution": "37", "Image ResolutionUnit": "Pixels/Centimeter", "Image Software": "SlidePlayer", "Image YCbCrPositioning": "Centered"}