Botnets — Detection, classification and countermeasures

Different species of malicious software (malware) have been around for quite a while. Add a command and control structure - and here you are: A "cyber army" of hijacked machines waiting for the commands of the so-called "bot herder" ready to serve the master's will. Botnets may be used for distributing spam, for installing additional malware, for information harvesting, for distributed denial of service attacks and for other actions initiated and controlled by the bot herder. Today, thousands of botnets are well understood. Their actions are observed and in some cases controlled/limited. In addition, experts active in this field argue that there is a very large number of botnets escaping tracking efforts by mechanisms such as frequent reconfiguration and frequent migration of command-and-control structures. In his keynote, Peter Martini will comment on the challenge of detecting botnets, on aggregation and clustering of similar species of malicious software and on countermeasures used today. He will comment on the relevance of botnet size and the problem of measuring the current size of well-known botnets. Finally, he will comment on legal issues and missing pieces in the fight against botnets: Botnets have come to stay.