Known botnet detection

The Advanced Callback Detection framework also uses a deterministic botnet detection approach, targeted toward detection of known bots. As mentioned earlier, a bot lifecycle can be divided into exploitation, infection and the attack/propagation phases. Each phase has a corresponding attack signature to detect the phase. The framework monitors per source IP address the specified sequence of these attack IDs within a specified time to trigger a correlated attack. This provides a precise bot detection.

Consider the example of Kraken botnet. Kraken bot is known to have the following phases:

Phases 1 and 2 are not malicious by themselves. However, when correlated with phases, 3,4,5 and 6, Kraken botnet can be detected effectively.