Cisco Cisco ASA 5545-X Adaptive Security Appliance 데이터 시트

White Paper

Page 1 of 11

Combating Botnets Using the Cisco ASA Botnet Traffic Filter

This paper discusses the nature of botnets, the threats they pose to today’s networks, and how the Cisco

Botnet Traffic Filter enables Cisco ASA appliances to fight botnets and to handle their dynamic nature.

Botnet Overview

A botnet is a collection of autonomous software robots (bots), typically malicious in nature, that operate as a network

of compromised computers. An originator, also known as a “bot herder,” typically controls the bots, and can launch

them at will, using command and control communication between the controller and the bots.

Hackers typically use botnets as a way of gaining access to large distributed resources of computing power. The

owner of a botnet determines which users are allowed to access their botnet. It is a common practice to even sell

access to the botnet.

The following is a typical example of the operation of a botnet:

●

A botnet operator will infect computers by sending out viruses or worms through various infection vectors,

such as email or compromised websites where the malicious application is the bot.

●

The bot on the newly infected host will log into a command and control server and await commands. In many

cases, the command and control server will be an IRC channel or a web server.

●

A botnet user acquires access to the botnet from the botnet operator.

●

Instructions are sent through the command and control channel to each bot in the botnet to execute actions,

such as mass email spam, distributed denial of service (DDoS) attacks, or information theft.

This is illustrated in Figure 1.

Figure 1. Botnet Infection Process