Re: detecting network crowd surges

[Jose Nazario <jose () monkey org>]

On Tue, 8 Aug 2006, mikeiscool wrote:

> I wonder, though, is this how real botnets are controlled?

based on our measurements and observations, IRC is the dominant method for 
botnet control at this time. but HTTP methods, similar to the ones you 
described, are coming on in popularity. poll frequencies range from 5 
seconds to 1 hour or more.

________
jose nazario, ph.d.                 jose () monkey org
http://monkey.org/~jose/            http://monkey.org/~jose/secnews.html
                                    http://www.wormblog.com/

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------