Botnet Detection and Assessment

This unit examines modern detection methods, transparent techniques, and risk-scoring frameworks used to discover and prioritize botnet activity. Students will learn to perform high- and low-level quantitative assessments, construct feedback loops, and evaluate response strategies to identify botnets and prepare for incident mitigation.

Learning Objectives

• Analyze the evolution and transparency of botnet detection methods by comparing signature-based, anomaly/behavioral, and hybrid approaches and selecting appropriate methods for specified network scenarios
• Apply quantitative and qualitative assessment techniques, including volume-based metrics and low-level indicators, to telemetry datasets to compute risk scores and prioritize suspected botnet incidents
• Demonstrate the design and operation of a feedback loop that adjusts detection thresholds and scoring rules, documenting changes and measuring effects on detection accuracy (false positives/false negatives)
• Evaluate response strategy assessments and established guidelines to identify high-priority botnet indicators, recommend mitigation priorities, and prepare actionable handoffs for incident response