Botnet Detection and Assessment

This unit examines the evolution of detection techniques and how transparent detection methods, risk scoring, and multiple assessment levels (high-level, quantitative, low-level) are used to identify botnet activity. Students will practice computing risk scores, applying assessment guidelines, and designing feedback loops and response strategies to prioritize and improve detection outcomes.

Learning Objectives

• Analyze the evolution of detection methods and distinguish transparent detection techniques from opaque approaches, citing technical strengths, weaknesses, and use cases
• Apply quantitative (volume-based) and low-level assessment techniques to compute risk scores and prioritize suspected botnet activity using provided datasets and scoring models
• Evaluate assessment outputs and response strategies against established guidelines to recommend remediation priorities and measure the effectiveness of detection and feedback loops
• Design an integrated assessment workflow that documents prerequisites, assessment guidelines, identification procedures, and a continuous feedback loop to improve botnet detection and response readiness