# A Survey on Botnets: Incentives, Evolution, Detection and Current Trends
## 6 Detection and Mitigation
### Mitigation Mechanisms
#### 6.2.1 Best Practices for End-Users and Organisations  
In general, following IT best practices is a good way to avoid the propagation and infection of botnets. An article of Justice news [53] coming from the Department of Justice (DOJ) of the United States announced \"a multi-national effort to disrupt the Gameover Zeus Botnet\". The GameOver Zeus (GOZ) botnet is described as being capable of infecting victim computers to harvest credentials and banking information in order to gather millions of dollars from companies and customers. Therefore, a cybersecurity alert [200] at the National Cyber Awareness System has been released to explain how the botnet works and how attacks can be avoided. This assessment and mitigation document is written in collaboration with Department of Homeland Security (DHS), the DOJ and the Federal Bureau of Investigation (FBI). From this source, it is possible to get a grasp on the default methods of countermeasures used against every common botnet or malware:  
* **Updating/changing passwords**: typically, botnets will try to access credentials from all connected devices and web accounts. The best way of protection is to follow \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Mitigation Mechanism** & **Advantages** & **Disadvantages** & **Papers** \\ \hline Best practices for end-users and organisations & Increases overall organisational security, considered best-practice, many well-known standards (i.e., ISO 27001). & Does not specifically target botnets, high user inconvenience cost. & [53,200] \\ \hline Network-level blocking and packet analysis & Very high protection rate, many solutions and detection frameworks. & Very botnet-specific, can introduce additional latency at network edge. & [5,84,98,136,176,201,202,203, 204, 205] \\ \hline Honeypots and botnet isolation & No effect on internal networks. Low cost. & Lower protection rate compared to network-level blocking, requires additional logically separated network. & [13,22,33,206,207, 208] \\ \hline Attacking P2P botnets & Helps mitigate botnet threat for others. Can target specific botnets. Hinders P2P advantages compared to centralised C\&C & Only targets specific botnets (P2P-based). Low efficiency for organisations. & [209,210] \\ \hline IoT-specific mitigation strategies & Low or offloaded compute resource cost. Some solutions provide general integrity for IoT-based networks. & Specific for IoT-based threats. Still few and untested options compared to network-level blocking. & [2,106,175,211,212] \\ \hline Community-driven approaches & Potentially quicker adaption to newer botnets. Free and Open Source for organisations to use. & Dependent on community development. No de-facto standard decided yet. & [119,213] \\ \hline Botnet mitigation with ethical issues (spreading anti-botnets, attacking suspected hosts) & Mitigates botnets for others. Slows botnet propagation. & Ethically questionable or illegal. Very specific per-botnet. & [49,82,214,215,216,217,217,218,219,220,215,214,216,217] \\ \hline \hline \end{tabular}
\end{table} 
Table 9: This table details the specific mitigation methods described in the following section, the advantages and disadvantages, as well as associated papers. the rules of ensuring high entropy of random password generation and execute frequent updates. * **Updating devices**: infections are coming from unwanted vulnerabilities. Updating the operating system and the integrated software can help prevent devices from being compromised. * **Updating/using anti-malware and anti-virus tools**: remediation tools and anti-viruses can erase malware infection and protect the device against new ones. * **Being aware**: the hardest part to protect from is human behaviour. There ar multiple incentives, but botnets such as GOZ are mostly coming from spam and phishing messages, which can be avoided if the potential victim is aware of this potential threat source. However, individual techniques are often not efficient enough to eradicate such threats.