# A Survey on Botnets, Issues, Threats, Methods, Detection and Prevention
## 5 Prevention and Mitigation Strategies  
Relating to [PERSON] et al. [16] in terms of botnet infections originating from phishing-based attacks, [PERSON] and [PERSON] [63] mentions that social engineering attacks can be avoided by providing staff with training on how to respond to different social engineering-based threats. [PERSON] and [PERSON] [63] defines this as cyber-attacks that depend on deceiving human users. The training procedures, discussed by [PERSON] and [PERSON] [64], are essential to prevent phishing-based attacks as providing user training on how to respond properly to unknown emails. [PERSON] [65] and [PERSON] and [PERSON] [63] discuss methods to ensure links that have been emailed to users are checked and not accessed. However, [PERSON] [65] highlighted an issue that the source does not go into further details on the prevention side of botnets. However, the use of email attachments needs to be examined before access [63]. Another aspect highlighted by [PERSON] [65] is that the open ports that the system does not use must be closed. This relates to Tunggal [8] as bot-masters would use open ports to be able to access the network hosts. This means that all unused ports should be closed and only allow one that is secure and needed to communicate with other devices to be left open. In the case of brute-force attacks, one such method that is mentioned by both [PERSON] [66] and [PERSON] et al. [67] are implementing the use of account locking in sessions. This is where password insertion for authentication is given a limited number \begin{table}
\begin{tabular}{l l l} \hline \hline  & **Positive** & **Negative** \\ \hline Positive & Spam & Spam Email classified as Non-Spam \\ Negative & Non-Spam Email but classified as Spam & Non-Spam \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Spam filtering confusion matrix. of times. The maximum would usually be set to three attempts for users to authenticate themselves before they are forced out of the session. In the case of botnets, those that would attempt to access SSH sessions would only be able to use three insertions, allowing for sessions to be more secure and decreasing the chances of being vulnerable to brute-force attacks. Although, this comes with the drawback of limiting the attempts for legitimate users on the network if they would forget the SSH passwords. Another measure would be to use secure passwords by using a mix of letters, numbers and special characters at a specific length, thereby it can also mitigate dictionary attacks as strong passwords may not be actual words [65]. This is validated by [PERSON] [66] as it provided a similar idea of using an attempt limit on the sessions. Although [66] also has a unique aspect of mentioning the use of providing a delayed response. Lengthening the duration of the password check on the system can also ensure that the botnet conducting the brute force attack will not be able to keep attempting at a rapid rate. [PERSON] [65] suggests ensuring that updated firewalls are implemented into networks. Botnets can cause anomalies into standard traffic flow within the targeted network, which would mean that there would be suspicious packets within the traffic [3, 25]. Therefore, configuring the firewalls would allow for the suspicious packets to be analysed. If the packet contains malware code, the security system filters the packet and denies access to the host it is trying to enter. Although this comes with the drawback of networks placing firewalls in the wrong areas and would allow the bot-master to use the vulnerable parts to perform the exploitation [68]. This can also coincide with the vulnerability of security misconfiguration, meaning that the security needs to be implemented properly and applying the firewalls correctly to ensure that botnet attacks, and cyber-attacks in general, do not harm the system. Botnets are likely to traverse the network through using open services that will not be used, in the targeted network such as using UDP protocols along with using ports of a specific protocol [69].