Detection of Zeus Bot Based on Host and Network Activities

Abstract

Botnet is a network of host machines infected by malicious code. Infected machines are bots that perform illegitimate activities with the help of bot master who has remote control over the bot machine. The infected bot machine performs actions such as key logging, information harvesting, and Denial of Service. The challenge is to identify the Zeus bot activity by monitoring the network and host activities. Monitoring the network activities leads to identification of communication patterns between bot and outside network. Monitoring host activities can effectively identify abnormal host activities. In this paper we propose a methodology to analyse and identify the presence of Zeus bot. Analysis is performed by observing the host and network activities of a machine. Based on the analysis we propose a system that consists of three modules, viz: Folder monitoring, Network monitoring, and API Hooks monitoring. The folder monitoring module monitors the folder in which the Zeus bot executable gets stored. The network monitoring module deals with capturing the host network lively and compares with a predefined pattern which consists of the communication pattern between the bot and its master. The pattern is fixed after monitoring the network of the host machine before and after infection. The API hook monitoring module monitors the API hooks used for stealing the credentials. Finally the Integrated decision module is triggered which decides whether the system is infected by Zeus bot based on three conditions.