Botnet Command and Control Mechanisms

Botnet is most widespread and occurs commonly in today´s cyber attacks, resulting in serious threats to our network assets and organization´s properties. Botnets are collections of compromised computers (Bots) which are remotely controlled by its originator (BotMaster) under a common commond-and-control (C & C) infrastructure. They are used to distribute commands to the Bots for malicious activities such as distributed denial-of-service (DDoS) attacks, sending large amount of SPAM and other nefarious purposes. Understanding the Botnet C & C channels is a critical component to precisely identify, detect, and mitigate the Botnets threats. Therefore, in this paper we provide a classification of Botnets C & C channels and evaluate well-known protocols (e.g. IRC, HTTP, and P2P) which are being used in each of them.