A 6LoWPAN based Botnet Detection Mechanism Using Botnet Traffic Characteristics
Eung Jun Cho, Jinho Kim, Choong Seon Hong · 2011
Recently, Botnets are used as malicious tools for sending spam-mail, logging keys and launching DDoS attacks, A Botnet is a network of Bots which are controlled by an attacker, and it is composed of several Bots and C&C (Command and Control) servers. The attacker sends commands to the C&C server in order to spread commands among the Bots. In this way, it is hard to find the attacker because there is no direct connection between the Bots and the attacker. A lot of mechanisms have been proposed to detect the Botnet on wired networks, and there are a number of commercial products to detect the Botnet. However, in a IP-based sensor network environment, especially in a 6LoWPAN (IPv6 over Low power WPAN), there is no detection mechanism for the Botnet attacks. In this paper, we analyze the threat of Botnet in a 6LoWPAN, and propose a mechanism to detect Botnet in a 6LoWPAN using characteristics of Botnet traffic. We also present the implementation of our mechanism in a 6LoWPAN environment.