Botnet Detection and Assessment

This unit examines the evolution of botnet detection methods, contrasts transparent detection approaches with traditional techniques, and teaches systematic assessment practices for identifying botnets. Students learn risk scoring, quantitative and qualitative assessment methods, feedback loops, and how to evaluate response strategies to prepare for mitigation and incident response in the subsequent unit.

Learning Objectives

• analyze the evolution of botnet detection methods and compare transparent detection techniques with traditional approaches, identifying trade-offs in visibility, false positives, and scalability
• apply high-level and low-level assessment frameworks to network and host data, performing quantitative (volume-based) assessments to detect and characterize botnet activity
• demonstrate calculation and interpretation of risk scores and implement feedback loop mechanisms to prioritize alerts and refine detection thresholds iteratively
• evaluate response strategy assessment guidelines and identify botnet indicators to produce prioritized, actionable recommendations that address prerequisites for effective mitigation