{"id":20157,"date":"2020-01-29T13:10:21","date_gmt":"2020-01-29T13:10:21","guid":{"rendered":"https:\/\/www.arimetrics.com\/glosario-digital\/botnet"},"modified":"2026-09-18T17:07:36","modified_gmt":"2026-09-18T17:07:36","slug":"botnet","status":"publish","type":"encyclopedia","link":"https:\/\/www.arimetrics.com\/en\/digital-glossary\/botnet","title":{"rendered":"Botnet"},"content":{"rendered":"<p><img decoding=\"async\" class=\"boxpad alignright wp-image-13983 size-full\" src=\"https:\/\/www.arimetrics.com\/wp-content\/uploads\/2020\/01\/botnet-1.png\" alt=\"Botnet\" width=\"300\" height=\"300\" srcset=\"https:\/\/www.arimetrics.com\/wp-content\/uploads\/2020\/01\/botnet-1.png 300w, https:\/\/www.arimetrics.com\/wp-content\/uploads\/2020\/01\/botnet-1-150x150.png 150w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><strong>Definition:<\/strong><\/p>\n<p>A <strong>botnet<\/strong> is a network of connected devices that have been compromised and placed under a control system to perform coordinated actions. Each controlled device is known as a bot or zombie and may be a computer, server, phone, router, camera or another connected device.<\/p>\n<p>The operator directs the network through command-and-control infrastructure. Device owners are commonly unaware that their equipment is participating. <strong>A botnet is not simply any collection of bots:<\/strong> in cybersecurity, the term describes a network that is normally controlled without authorisation to perform malicious or abusive activities.<\/p>\n<p><code><\/code><\/p>\n<h2>How a botnet works<\/h2>\n<p>Creating and operating a botnet commonly involves three stages:<\/p>\n<ul>\n<li><strong>Recruitment:<\/strong> The attacker compromises devices through vulnerabilities, weak or default credentials, malicious files, phishing or other techniques. Installed <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/malware\">malware<\/a> provides continued access or executes instructions.<\/li>\n<li><strong>Command and control:<\/strong> Devices communicate with servers controlled by the operator or with other nodes in a distributed architecture. They receive instructions, configurations and updates through this infrastructure.<\/li>\n<li><strong>Execution:<\/strong> Nodes perform the assigned task, report results and may change targets. The operator can activate only part of the network or coordinate the entire botnet for a campaign.<\/li>\n<\/ul>\n<p>A centralised architecture depends on one or more command-and-control servers. A peer-to-peer architecture distributes communications and can make the network harder to disable by blocking a single point. The <a href=\"https:\/\/csrc.nist.gov\/glossary\/term\/botnet\" target=\"_blank\" rel=\"noopener\">NIST cybersecurity glossary<\/a> provides reference definitions for this concept.<\/p>\n<p>A <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/bot\">bot<\/a> can be legitimate and perform authorised automation. In a botnet, the nodes act together under a third party&#8217;s control. <strong>Compromised devices are also victims:<\/strong> participation in the network does not mean that their owners are voluntarily involved in an attack.<\/p>\n<h2>Uses of botnets<\/h2>\n<p>The same botnet can support several activities and change function when it receives new instructions:<\/p>\n<ul>\n<li><strong>Distributed denial-of-service attacks:<\/strong> Many devices send traffic or requests to a target to degrade or interrupt its availability.<\/li>\n<li><strong>Spam and malware distribution:<\/strong> The network can send <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/spam\">spam<\/a>, propagate malicious links, deliver files or help compromise more devices.<\/li>\n<li><strong>Data theft and fraud:<\/strong> Some nodes capture credentials, sessions or information, perform automated access attempts or participate in fraudulent operations.<\/li>\n<li><strong>Resource exploitation:<\/strong> A device&#8217;s processing power, connection or IP address can be used for unauthorised cryptomining, advertising fraud, proxy traffic or the resale of access.<\/li>\n<\/ul>\n<p>Botnets can also be rented or divided between different campaigns. <strong>The harm is not limited to the activity&#8217;s target:<\/strong> recruited devices consume resources, expose data and may provide an entry point to other networks.<\/p>\n<h2>Botnet detection<\/h2>\n<p>Detection combines signals from the device, network and external services:<\/p>\n<ul>\n<li><strong>Anomalous communications:<\/strong> Periodic connections to unknown destinations, unusual DNS queries, unexpected outbound traffic or contact with infrastructure identified as malicious.<\/li>\n<li><strong>Device changes:<\/strong> Unknown processes or services, sustained resource use, modified security settings, update failures or activity while the device should be idle.<\/li>\n<li><strong>External indicators:<\/strong> Provider alerts, poor IP address reputation, unauthorised messages, unusual logins or notices that the device is participating in abusive traffic.<\/li>\n<\/ul>\n<p>These indicators do not prove an infection on their own. Slow performance, fan activity or a pop-up window may have other causes. <strong>Confirmation requires correlating logs, processes, connections, security events and threat indicators.<\/strong><\/p>\n<p>Detection differs when an organisation is the botnet&#8217;s target rather than the owner of a compromised node. In that case, analysis focuses on distributed traffic patterns, request frequency, client behaviour and effects on service availability.<\/p>\n<h2>Response and prevention<\/h2>\n<p>The response depends on whether the affected party manages a compromised device or an attacked service:<\/p>\n<ul>\n<li><strong>Compromised device:<\/strong> It can be isolated from the network while the access mechanism is identified. Sessions and credentials need to be revoked from a clean device, the malware removed or the system reinstalled, the vulnerability corrected and malicious communications checked for recurrence.<\/li>\n<li><strong>Affected network or service:<\/strong> Controls may include filtering, rate limits, indicator blocking, segmentation and DDoS mitigation services. Coordination with connectivity, hosting or response providers becomes necessary when the activity exceeds internal capacity.<\/li>\n<\/ul>\n<p>Prevention combines asset inventory, updates, removal of default credentials, stronger authentication, segmentation and outbound-traffic monitoring. A <a href=\"https:\/\/www.arimetrics.com\/en\/digital-glossary\/firewall\">firewall<\/a> can block particular communications but does not replace vulnerability remediation or investigation of devices that have already been compromised.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Definition: A botnet is a network of connected devices that have been compromised and placed under a control system to perform coordinated actions. Each controlled device is known as a bot or zombie and may be a computer, server, phone, router, camera or another connected device. The operator directs the network through command-and-control infrastructure. Device [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":80075,"template":"","encyclopedia-tag":[1265],"class_list":["post-20157","encyclopedia","type-encyclopedia","status-publish","has-post-thumbnail","hentry","encyclopedia-tag-web-threats"],"_links":{"self":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia\/20157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia"}],"about":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/types\/encyclopedia"}],"author":[{"embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/users\/6"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/media\/80075"}],"wp:attachment":[{"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/media?parent=20157"}],"wp:term":[{"taxonomy":"encyclopedia-tag","embeddable":true,"href":"https:\/\/www.arimetrics.com\/en\/wp-json\/wp\/v2\/encyclopedia-tag?post=20157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}