Delay-Tolerant Botnets

Botnets have become one of top threats to the Internet. Many detection methods have been developed to distinguish botnet behaviors from normal human behaviors. Future botnets, however, may incorporate the characteristics of human beings and weaken the existing detection techniques. In this work, we study an intelligent botnet, called the delay-tolerant botnet, that intentionally adds random delays to the command propagation and endeavors to avoid the detection. We then apply mathematical analysis to derive the average delay required to distribute a command to all bots in three types of command and control architectures: centralized, distributed, and hybrid delay-tolerant botnets. We find that in all cases, the delay increases approximately logarithmically with the number of bots, indicating that the delay-tolerant botnets are scalable. Finally, we verify the analytical results by simulations.