Cyber Crime and Cyber Terrorism

FIGURE 17.11
Protocols failure messages.

---

253
 
Conclusion and future trends (tor, mobile and social networks)
they can hide their critical servers behind proxy services so that they are more dif-
ficult to identify and take down.
Hence, by studying the DNS behavior of known malicious and benign domains, 
as largely as possible in terms of observation time and traffic volume observed, 
could possibly identify the distinguishable generic features that are able to define 
the maliciousness of a given domain. For example the 15 different features listed in 
Figure 17.12
 may be indicative to detect malicious behaviors.
There are many other approaches aimed at the identification, enumeration, and 
poisoning usually referred to the P2P botnet (peer crawling). These approaches com-
monly deal with very vertical studies of small botnet families, if not the single botnet. 
The basic idea is to try to join with a particular botnet and contextually understand 
its architecture, protocols, size and then subsequently outline its disruption or simply 
mitigation modes.
CONCLUSION AND FUTURE TRENDS (TOR, MOBILE AND 
SOCIAL NETWORKS)
The temple of botnets relies on three main pillars (
Figure 17.13
). The pervasive dif-
fusion of the Internet fortifies these three pillars. All devices equipped with internet 
connectivity can potentially become future zombies. In fact, the main candidates are 
currently smartphones and tablets and we have already witnessed criminal actions 
due to the spread of malware for mobile devices (e.g., ZITMO).
Still few people are aware of the risks that can arise from a modern device. The 
technological convergence is more and more invasive—almost all everyday life ob-
jects are “Internet connected” and smart. There will hardly ever be a countertrend.