Module 12: AdaBoost; SGD and security application

Question 1

Botnet

Answer 1

Network made up of computers controlled remotely by third party, OR network of hijacked computers used to carry out scams and cyberattacks

Question 2

Types of botnet attacks

Answer 2

DDoS (Distributed Denial of Service) attacks
Sending spam, viruses, spyware
Phishing
Stealing
Click fraud

Question 3

What do botmasters use to hide commands?

Answer 3

DNS services

Question 4

C&C (Command and Control) server

Answer 4

Server used by cybercriminals to send orders and receive reports from bots

Question 5

Centralized client-server botnet model

Answer 5

Provides botmaster direct access. Weakness: when traced, all botnets become useless. Uses IRC and HTTP.

Question 6

Decentralized P2P (peer to peer) botnet model

Answer 6

Any bot can act as client or server or both simultaneously. Difficult to capture or shut down. Each bot has its own encryption design.

Question 7

Botnet steps

Answer 7

Infection
Command and Control (C&C)
Task Assignment
Execution of Tasks
Reporting

Question 8

Ways to find botnets

Answer 8

Network Traffic Analysis
Signature-Based Detection
Behavior-Based Detection
Honeypots
Machine-Learning-Based Detection