Behavioral analysis of zombie armies

Olivier Thonnard, Wim Mees, Marc Dacier

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)


Zombie armies-or botnets, i.e., large groups of compromised machines controlled remotely by a same entity-pose today a significant threat to national security. Recent cyber-conficts have indeed demonstrated that botnets can be easily turned into digital weapons, which can be used by cybercriminals to attack the network resources of a country by performing simple Distributed Denial-of Service (DDoS) attacks against critical web services. A deep understanding of the longterm behavior of botnet armies, and their strategic evolution, is thus a vital requirement to combat effectively those latent threats. In this paper, we show how to enable such a long-term, strategic analysis, and how to study the dynamic behaviors and the global characteristics of these complex, large-scale phenomena by applying different techniques from the area of knowledge discovery on attack traces collected on the Internet. We illustrate our method with some experimental results obtained from a set of worldwide distributed server honeypots, which have monitored attack activity in 18 different IP subnets for more than 640 days. Our preliminary results highlight several interesting findings, such as i) the strong resilience of zombie armies on the Internet, with survival times going up to several months; ii) the high degree of coordination among zombies; iii) the highly uneven spatial distribution of bots in a limited number of "unclean networks", and iv) the large proportion of home users' machines with high-speed Internet connexions among the bot population.

Original languageEnglish
Title of host publicationCryptology and Information Security Series
Number of pages20
Publication statusPublished - 2009
Externally publishedYes

Publication series

NameCryptology and Information Security Series
ISSN (Print)18716431
ISSN (Electronic)18798101



  • Intelligence monitoring
  • Threat analysis
  • Zombie armies

ASJC Scopus subject areas

  • Computer Science Applications
  • Information Systems
  • Electrical and Electronic Engineering

Cite this

Thonnard, O., Mees, W., & Dacier, M. (2009). Behavioral analysis of zombie armies. In Cryptology and Information Security Series (Vol. 3, pp. 191-210). (Cryptology and Information Security Series; Vol. 3).