Behavioral analysis of zombie armies

Olivier Thonnard, Wim Mees, Marc Dacier

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Scopus citations


Zombie armies-or botnets, i.e., large groups of compromised machines controlled remotely by a same entity-pose today a significant threat to national security. Recent cyber-conficts have indeed demonstrated that botnets can be easily turned into digital weapons, which can be used by cybercriminals to attack the network resources of a country by performing simple Distributed Denial-of Service (DDoS) attacks against critical web services. A deep understanding of the longterm behavior of botnet armies, and their strategic evolution, is thus a vital requirement to combat effectively those latent threats. In this paper, we show how to enable such a long-term, strategic analysis, and how to study the dynamic behaviors and the global characteristics of these complex, large-scale phenomena by applying different techniques from the area of knowledge discovery on attack traces collected on the Internet. We illustrate our method with some experimental results obtained from a set of worldwide distributed server honeypots, which have monitored attack activity in 18 different IP subnets for more than 640 days. Our preliminary results highlight several interesting findings, such as i) the strong resilience of zombie armies on the Internet, with survival times going up to several months; ii) the high degree of coordination among zombies; iii) the highly uneven spatial distribution of bots in a limited number of "unclean networks", and iv) the large proportion of home users' machines with high-speed Internet connexions among the bot population. © 2009 The authors.
Original languageEnglish (US)
Title of host publicationCryptology and Information Security Series
PublisherIOS PressNieuwe Hemweg 6BAmsterdam1013 BG
Number of pages20
ISBN (Print)9781607500605
StatePublished - Jan 1 2009
Externally publishedYes

Bibliographical note

Generated from Scopus record by KAUST IRTS on 2022-09-12

ASJC Scopus subject areas

  • Information Systems
  • Electrical and Electronic Engineering
  • Computer Science Applications


Dive into the research topics of 'Behavioral analysis of zombie armies'. Together they form a unique fingerprint.

Cite this