detection of networks blocks used by the storm worm botnet
Storm Worm is a prolific web-spread Trojan virus that infects computers and turns them into nodes (called bots) of a botnet. The bots then can be used to distribute spam messages, launch DOS attacks, host phishing web sites, etc. This paper investigated Storm Worm bots that were used to propagate the virus during a four-month period of time. We found certain network blocks, because of their vulnerability, were more likely to contain Storm Worm bots.
spam forensic analysis electronic mail data mining cyber crime