BotHunter A passive network monitoring tool designed to recognize the communication patterns of malware-infected computers within your network perimeter
Download

BotHunter Ranking & Summary

BotHunter Tags

network diagnose malware infection diagnosis diagnose malware infection netowrk monitor malware infection

BotHunter Description

A passive network monitoring tool designed to recognize the communication patterns of malware-infected computers within your network perimeter Using an advanced infection-dialog-based event correlation engine (patent pending), BotHunter represents the most in-depth network-based malware infection diagnosis system available today.BotHunter is an application designed to help you track the two-way communication flows between external entities and internal assets, developing an evidence trail of data exchanges that match a state-based infection sequence model.BotHunter consists of a correlation engine that is driven by a customized and augmented release of Snort version 2, which tracks the underlying actions that occur during the malware infection process: inbound scanning, exploit usage, egg downloading, outbound bot coordination dialog, outbound attack propagation, and malware P2P communication. The BotHunter correlator then ties together the dialog trail of inbound intrusion alarms with those outbound communication patterns that are highly indicative of successful local host infection. When a sequence of evidence is found to match BotHunter's infection dialog model, a consolidated report is produced to capture all the relevant events and event sources that played a role during the infection process. BotHunter is available free for both experimental operational use and to help stimulate research in understanding the life cycle of malware infections. Requirements: · 1 GB RAM or more · At least 1 Ethernet NIC/WIC (for network monitoring)

BotHunter Related Software