Cooperative network behavior analysis model for mobile HTTP botnet detection / Meisam Eslahi

Recently, BYOD or Bring Your Own Device has become one of the most popular methods for enterprises to provide mobility and flexibility in workplaces. The emergence of new technologies and features of mobile devices makes them integral part of every aspect of daily business activities. On the other hand, mobile devices are not well protected compared to computers and their users pay less attention to security updates and solutions , therefore, these new capabilities (e.g. high internet speed and processing power) have motivated the attackers to migrate to mobile infrastructures. Thus, mobile security has become a crucial issue in BYOD or Bring Your Own Device as the employees use their own mobile devices to access an organization data and systems. The mobile attacks and threats come in different forms, such as viruses and worms. However, Mobile Botnets or MoBots are more dangerous as they pose serious threats to mobile devices and communication networks. Bot and Botnets are sophisticated form of organized cyber-crime, which infect different targets (e.g. computers or mobile devices) without attracting the users’ attention, which subsequently communicates with each other by using a Command and Control (C&C) mechanism. The main intention of Botnets is to steal the private and personal information (e.g. Zeus and Zitmo) or sensitive information of organizations (e.g. Flame and Stuxnet), thus, several techniques such as encryption and use of standard protocols (e.g. HTTP and Port 80) employed by Botmasters to develop foolproof C&C mechanism which are difficult to detect.