The primary motivation for computer hacking has shifted away from vandalism and recognition in the hacker community to one of financial gains via malicious attacks and intrusions. The increasing sophistication of Internet attacks aims to exploit individuals and organizations for profit, often resulting in huge financial losses and business disruption.

One of the biggest threats to the Internet is the presence of large pools of compromised computers, also known as botnets, sitting in homes, schools, businesses and governments around the world. Under the control of a single hacker, botnets are often used to conduct various attacks. Botnets can assemble a tremendous amount of aggregate computing power and can perform a variety of attacks against a wide range of targets. Because of this, hackers are increasingly interested in using botnets to maximize their financial gains. At the same time, the degree of destruction caused by hackers using botnet attacks is hundreds of times larger than traditional, discrete attacks.

This paper has been written as a working document, aiming at facilitating better understanding of botnet behavior, detection, and mitigation.