Hands-On Artificial Intelligence for Cybersecurity

The botnet kill chain

In order to promptly identify the possible presence of a botnet, it may be useful to consider its kill chain (the different phases that characterize its realization).

We can, therefore, distinguish the following phases:

• Malicious software installation
• Joining the botnet via C2
• Spreading the botnet to other hosts

Among the events to constantly monitor for the possible presence of a botnet, the connections made at regular intervals to remote hosts should be included. Rather than monitoring the quality of the traffic itself (very often, in fact, botnets make use of apparently harmless communication protocols, such as HTTP traffic, using the service's default port 80, in order to mask its presence within the logs files), ...