Analysis of HTTP2P botnet: case study waledac

Malicious botnet is evolving very quickly and using the many ways to evade detection system. The change of protocol is the most important part of the malicious botnet´s evolution and evasion techniques. The initial malicious botnet was using the IRC protocol for communication between the command and contorl server and the zombie system. After that they use the HTTP protocol on the firewall-friendly and the P2P protocol to escape a Client/Server architecture. Because Many researchers studied malicious HTTP or P2P botnet for detection, the malicious botnet began to use the distorted communication method called HTTP2P. In this paper, we study the malicious HTTP2P botnet, and we will give to help malicious HTTP2P botnet detection by analyzing waledac botnet.