The research of botnet detection and prevention

Abstract

Malwares have become a major threat in the Internet. Attackers intrude hosts by many different kinds of methods, such as social engineering, phishing, distributing viruses and worms. Users’ computers and important servers are unaware that they are infected by malwares, and are still working. Therefore, it results in that malwares are spreading and infecting other computers. Besides, broad bandwidth networks and high speed computers make the botnets to work easier. This paper aims to propose Snort intrusion detecting system to detect and prevent the malicious bots. Some rules are designed to collect the normal and abnormal packets of the Internet Relay Chat (IRC) protocol. Then, some PHP programs are combined with Linux Netfilter/Iptables firewall to block the abnormal packets and warn system administrators.