Understanding the Construction Mechanism of Botnets

The botnet construction mechanism (BCM) is one of the key technologies of the botnets and the most important issue to both the attackers and the defenders. To the best of our knowledge, although the BCM has been mentioned in many researching papers, it has not been systemically studied. In this paper, we attempt to discuss the BCM methodically. We first give both the definition and its formalized definition of the BCM, and then address the BCM through four components: the bot propagating mechanism, the bot joining mechanism, the construction mechanism of topology and the performances of the botnet. We further detail the elements of the four components and study the compatibilities between those elements. Finally we discuss the advantages and disadvantages of each element.