# Botnet Architectures Reference

## Centralized (Client-Server)

**How it works:** All bots connect to one or more C2 servers for instructions.

**Protocols:** HTTP/HTTPS, IRC, custom binary
**Strengths:** Simple implementation, easy command distribution
**Weaknesses:** Single point of failure, easier to take down
**Examples:** Zeus, SpyEye, early Emotet

**Analysis approach:**
- Identify C2 server addresses (hardcoded or DGA)
- Reverse engineer C2 protocol
- Monitor for new C2 infrastructure
- Sinkhole C2 domains for victim counting

## Decentralized (Peer-to-Peer)

**How it works:** Bots maintain peer lists and relay commands through the network.

**Protocols:** Custom P2P over UDP/TCP
**Strengths:** No single point of failure, resilient to takedown
**Weaknesses:** Complex implementation, slower command propagation
**Examples:** Gameover Zeus, Hajime, Mozi

**Analysis approach:**
- Identify bootstrap nodes and peer discovery mechanism
- Map peer communication protocol
- Analyze peer list management and update mechanism
- Identify any super-nodes or relay nodes

## Hybrid

**How it works:** Combines centralized C2 with P2P fallback or tiered proxy structure.

**Protocols:** Mixed - HTTP for primary, P2P for fallback
**Strengths:** Resilient and flexible
**Weaknesses:** Complex to implement and maintain
**Examples:** TrickBot, Emotet (later), Necurs

**Analysis approach:**
- Identify all communication channels
- Determine failover logic
- Map proxy/relay infrastructure
- Analyze each tier independently

## Fast Flux Networks

**How it works:** Rapidly rotate DNS A records to distribute C2 across compromised hosts.

**Single flux:** Rapidly changing A records (multiple IPs per domain)
**Double flux:** Rapidly changing both A records and NS records

**Detection:**
- Multiple A records per domain
- Very low DNS TTL values
- Geographically distributed IPs
- IPs belonging to residential/consumer ranges

## Domain Generation Algorithms (DGA)

**Purpose:** Generate C2 domains algorithmically so attacker only needs to register a few.

**Types:**
- **Time-based:** Seed from current date (day/week/month)
- **Seed-based:** Seed from hardcoded values or external data
- **Dictionary-based:** Combine real words for more legitimate-looking domains
- **Hash-based:** MD5/SHA of seed material determines domain characters

**Detection:** See `dga_detector.py` script and references/dga-algorithms.md