Discovery techniques for P2P botnets

Over the last few years, researchers and network operators have examined networks of DDoS agents, more recently called botnets due to their connection to Internet Relay Chat (IRC). In the continued quest to take down these networks of bots, two important questions arise: how to find the last one of them, and how many of them are there? When one reads about a 10000, 100000, 1 million node botnet, how much credibility does it have? Is botnet A really bigger than botnet B? The difficulty in accurately and stealthily assessing the size of the botnet often lies in the structure of the botnet itself,, such as IRC, HTTP, and P2P-based. We present a general overview of discovery techniques for networks of malware, and provide a glimpse at a two-year study of a P2P botnet. 1 Introduction and motivation Over the last few years, researchers and network operators have examined networks of DDoS agents, more recently called botnets due to their connection to Internet Relay Chat (IRC). In the continued quest to take down these networks of bots, two important questions arise: how to find the last one of them, and how many of them are there? When one reads about a 10,000