427 Botnet fm qxd

Document Outline

• Cover
• Contents
• Chapter 1: Botnets: A Call to Action
  • Introduction
  • The Killer Web App
  • How Big Is the Problem?
  • The Industry Responds
• Chapter 2: Botnets Overview
  • What Is a Botnet?
  • The Botnet Life Cycle
  • What Does a Botnet Do?
  • Botnet Economics
• Chapter 3: Alternative Botnet C&Cs
  • Introduction: Why Are There Alternative C&Cs?
  • Historical C&C Technology as a Road Map
  • DNS and C&C Technology
  • Alternative Control Channels
  • Web-Based C&C Servers
• Chapter 4: Common Botnets
  • Introduction
  • SDBot
  • RBot
  • Agobot
  • Spybot
  • Mytob
• Chapter 5: Botnet Detection: Tools and Techniques
  • Introduction
  • Abuse
  • Network Infrastructure:Tools and Techniques
  • Intrusion Detection
  • Darknets, Honeypots, and Other Snares
  • Forensics Techniquesand Tools for Botnet Detection
• Chapter 6: Ourmon: Overview and Installation
  • Introduction
  • Case Studies: Things That Go Bump in the Night
  • How Ourmon Works
• Chapter 7: Ourmon: Anomaly Detection Tools
  • Introduction
  • The Ourmon Web Interface
  • A Little Theory
  • TCP Anomaly Detection
  • UDP Anomaly Detection
  • Detecting E-mail Anomalies
• Chapter 8: IRC and Botnets
  • Introduction
  • Understanding the IRC Protocol
  • Ourmon’s RRDTOOL Statistics and IRC Reports
  • Detecting an IRC Client Botnet
  • Detecting an IRC Botnet Server
• Chapter 9: Advanced Ourmon Techniques
  • Introduction
  • Automated Packet Capture
  • Ourmon Event Log
  • Tricks for Searching the Ourmon Logs
  • Sniffing IRC Messages
  • Optimizing the System
• Chapter 10: Using Sandbox Tools for Botnets
  • Introduction
  • Describing CWSandbox
  • Examining a Sample Analysis Report
  • Interpreting an Analysis Report
  • Bot-RelatedFindings of Our Live Sandbox
• Chapter 11: Intelligence Resources
  • Introduction
  • Identifying the Information anEnterprise/University Should Try to Gather
  • Places/Organizations WherePublic Information Can Be Found
  • Membership Organizations and How to Qualify
  • Confidentiality Agreements
  • What to Do with the Information When You Get It
  • The Role of IntelligenceSources in AggregatingEnough Information to Make LawEnforcement Involvement Practical
• Chapter 12: Responding to Botnets
  • Giving Up Is Not an Option
• Appendix A: FSTC Phishing Solutions Categories
• Index