The fight against botnets: from observation to strategy
Botnets, or networks of computers infected with malware and connected to a command and control system, is one of the main tools for criminal activities on the Internet today. They allow the development of a new type of crime: crime as a service (CaaS). They are a challenge for law enforcement. First by the importance of their impact on the security of networks and the commission of crimes on the Internet. Next, with regards to the extremely international dimension of their dissemination and therefore the enhanced difficulty in conducting investigations. Finally, through the large number of actors that may be involved (software developers, botnet masters, financial intermediaries, etc.). This thesis proposes a thorough study of botnets (components, operation, actors), the proposal for a data collection method on botnet related activities and finally the technical and organizational arrangements in the fight against botnets; it concludes on proposals on the strategy for this fight.
The work carried out has confirmed the relevance, for the effective study of botnets, of a model encompassing all their components, including infrastructure and actors. Besides an effort in providing definitions, the thesis describes a complete model of the life cycle of a botnet and offers methods for categorization of these objects.
This work shows the need for a shared strategy which should include the detection elements, coordination between actors and the possibility or even the obligation for operators to implement mitigation measures.
Defence : 11/12/2015 - 10h - Ecole militaire Jury members : M. Jean-Yves Marion, Professeur, Université de Lorraine [Rapporteur]
M. Ludovic Mé, Enseignant-chercheur, Supélec Rennes [Rapporteur]
M. David Naccache, Professeur, Ecole normale supérieure
M. Matthieu Latapy, Directeur de recherche, UPMC, LIP6
Mme Clémence Magnien, Directrice de recherche, UPMC, LIP6
Mme Solange Ghernaouti Professeure, Université de Lausanne
M. Vincent Nicomette, Professeur, INSA Toulouse
A. Malatras, E. Freyssinet, L. Beslay : “Mobile botnets taxonomy and challenges”, European Intelligence and Security Informatics Conference (EISIC), Manchester, United Kingdom, pp. 149-152, (IEEE) (2015)