Corero Network Security has analysed 3,322 distributed denial-of-service (DDoS) malware samples, identifying the range of attack methods used by modern botnets and the challenges these pose for network security. The research found that 80% of samples contained at least two attack types, while 60% included three or more, highlighting the need for protection that can respond to multiple threats simultaneously.
The analysis covered 17 CPU architectures and found that Mirai and its descendants accounted for 71% of samples, with Gafgyt representing a further 28%. These findings indicate that a relatively small number of established malware families continue to provide the basis for a wide range of attack variants.
The research also highlights how attackers exploit connected devices, including routers, internet protocol cameras, smart home equipment and network infrastructure. Weak passwords and unpatched software can allow these devices to be compromised and incorporated into botnets, providing attackers with the resources to target online services.
The study found that TCP floods appeared in 75% of the 1,577 samples whose attack code could be fully mapped, followed by UDP floods at 67% and HTTP/HTTPS application-layer attacks at 58%. Other methods included game-server attacks, techniques designed to bypass mitigation services, DNS floods and attacks using tunnelling protocols.
Application-layer attacks are particularly difficult to identify because they can imitate legitimate users. Some malware samples contained browser identification strings associated with Chrome, Firefox, Safari and mobile browsers. Others used techniques designed to bypass content delivery networks or increase the processing burden on target servers.
The research also identified techniques intended to evade conventional security measures. More than 500 samples used spoofed source IP addresses, while others continually changed packet characteristics to make detection through fixed signatures more difficult. Some malware disguised its processes as legitimate Linux system activity.
Corero’s research team uses its malware analysis to develop detection rules and mitigation methods. These are distributed through its DDoS Intelligence Service, which automatically delivers updated protection to customer deployments without requiring a software upgrade or manual intervention.
Corero Network Security plc (LON:CNS) is a global provider of automated business continuity and network security solutions.
