1

I know this may sound like a noob type question but, I want to know if there are any programs/techniques out there that scan for botnets being hosted on a server.

I run a small hosting company and sell kvm vpses. I just hate when the data center has to notify us of the issue and would rather be able to find and remove a botnet before the data Center has to tell us.

1
  • Require manual verification on orders and disable auto setup.
    – Jason
    May 6, 2014 at 1:38

1 Answer 1

2

This is a really complex problem, and continually moving. One of the better methods for finding this traffic is to run some kind of system on your egress traffic to identify which systems may be doing suspicious things. This will allow you to react proactively. It takes a lot of skill to tune these so they return relevant results, but it can be done; though it is a lot like whack-a-mole.

If you don't have access to your external traffic feed other than on the systems that generate them, third party products do exist to scan systems and traffic for suspicious activity. Some of the major AV vendors have system that can scan even Linux systems for this kind of thing. It's signature-based for the most part so it'll be known threats, but that's better than nothing.

1
  • I don't mean finding an irc botnet but instead an http botnet, but even so I run kvm vpses and from what I understand you can't really look into the files of a kvm guest, as to where you can with ovz. I mean if someone knew of a way i could view the files of a kvm guest and could explain it to me that would be great.
    – mike
    May 6, 2014 at 15:23

Not the answer you're looking for? Browse other questions tagged .