Botnets getting harder to kill

Currently, most botnets use a centralised command-and-control structure based on IRC, partly because there is such a deep existing body of knowledge and code base around the technology. But their centralised structure makes them relatively easy to shut down - a fact that hasn't stopped crooks from using them to take over large portions of the Internet.

Peer-to-peer (P2P) botnets are another matter. Taking their inspiration and underlying technology from the same P2P networks used to exchange files, they have no centralised control point, making them much harder to detect and shut down, the researchers said.

These botnets are an emerging phenomenon, but have already made a big impact. For their case study the researchers chose the botnet implanted by the Storm worm, called Trojan.Peacomm. Trojan.Peacomm first made an impact in January, but also had a major re-emergence last week.

IRC bots go back to 1993 in the case of the benevolent EggDrop bot, and 1998 in the case of GTbot and its variants, one of the first malicious botnets, the researchers said.