There are two general ways a complex problem can be solved, using a good approach or a bad one. The only good thing about the bad approach is that it will usually be simpler to understand and implement, but in the long run one will find that shortcuts don't always work. The good thing with most humans is that they learn from their mistakes and move forward. This is what we are seeing happen at the moment within the anti-malware industry. Host based anti-virus products are shifting their focus from signature based detection to advanced behavioral analysis and memory forensics. Network based sensors which used to rely heavily on DNS and IP black lists for detecting phishing attacks, SPAM emails and botnet command and controls are moving towards advanced protocol analysis and emulation.
The purpose of this series is to discuss limitations and challenges involved in using black lists (DNS & IP) for network based anomaly detections. I will focus more on the problems of tracking botnets using their control server identities alone. I will also discuss if there are better techniques available to detect compromised (botted) machines and terminate CnC channels to prevent further damage.
