\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={A Critical Investigation of Botnet},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2013-01-15 (revised: 15 January 2013)}
\def\TheID{\makeatother }
\def\TheDate{2013-01-15}
\title{A Critical Investigation of Botnet}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Parag  Bhalchandra}

             \author[2]{Dr. Khamitkar  S.D}

             \author[3]{Lokhande  S.N.}

             \affil[1]{  SRTM University, Nanded, MS, India}

\renewcommand\Authands{ and }

\date{\small \em Received: 11 December 2012 Accepted: 3 January 2013 Published: 15 January 2013}

\maketitle


\begin{abstract}
        


A Botnet is a network of compromised hosts, called as bots that are used for malicious activity. These bots are then controlled by single master termed as Botmaster. A Botmaster may inject commands though any bot to launch DDoS attack. In this paper, we have demonstrated the behavior of Botnet on network in real time Internet environment.This will be helpful for researcher to detect the different types of emerging Botnet.

\end{abstract}


\keywords{network security, botnet, denial of service attack.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
Botnet is large group of compromised hosts known as bots. Symantec \hyperref[b0]{[1]} defines a bot as "Bots are similar to worms and Trojans, but earn their unique name by performing a wide variety of automated tasks on behalf of their master". The bots are also known as zombies. . The Botnet are used for different attacks such as DDoS, spamming, phishing, sniffing, etc. These bots are controlled by a Botmaster through the command \& control (C\&C) mechanism as shown in figure \hyperref[fig_1]{1}. Based on this C\&C mechanism Botnet can classified into IRC, P2P and HTTP Botnet. 
\section[{II. COMMAND \& CONTROL (C\&C) MECHANISM}]{II. COMMAND \& CONTROL (C\&C) MECHANISM}\par
The Botmaster uses the C\&C mechanism to control the bots .This mechanism states the how Botmaster to assign the commands to the bots. The C\&C mechanism classified into centralized, P2P, IRC, and HTTP. a) Centralized This is the most widely used mechanism by the Botmaster. In this mechanism, a central server is used communication with bots. The commands are downloaded by the bots known as pull or sent to bots known as push. In push style the bots directly controlled by the Botmaster. While, in case of pull style Botmaster does not have direct control bot has to received the commands by interacting with C\&C server periodically \hyperref[b1]{[2]}. The IRC and HTTP protocols are widely used by this mechanism. 
\section[{b) P2P Mechanism}]{b) P2P Mechanism}\par
As the name implies there is no central server. The bot acts as client and server to form Botnet; hence Author ? : SRTM University's Sub center, Latur (MS), India.\par
Authors ? ? ? : School of Computational Sciences, SRTM University, Nanded, MS, India. c) IRC (Internet Relay Chat) This is the most popular and old mechanism used by the Botnet. The bots are connected to IRC server using IRC protocol. Bots communicates though push mechanism and they chats with each other with the help of commands. 
\section[{d) HTTP}]{d) HTTP}\par
Here the commands are not sent directly to the bots, instead it leaves malicious program on a web server and bot uses the pull mechanism for commands. 
\section[{III.}]{III.} 
\section[{BOTNET EXISTENCE PHASES a) Preliminary Infection and Transmission}]{BOTNET EXISTENCE PHASES a) Preliminary Infection and Transmission}\par
Botnet are formed though a vulnerable hosts. The Botmaster gain the access of infected host using different techniques such as operating system or application vulnerability. The Botmaster also uses the websites, emails as a spreading channel. When the user click on website link of opens an email the bot get installed on a victim's machine and become part of Botnet. \hyperref[b2]{[3]} b) C\&C Server Actions When the bot get installed on the Botmaster uses the pull or push methods for communication with bots. The C\& C server controls the bots though IRC channel. The bot get connected to IRC server with a nickname and then it join to Botnet. 
\section[{c) Accepting Instructions}]{c) Accepting Instructions}\par
When the bot joins the IRC Server Botmaster sends instructions to the bots. These instructions include commands which are used for various malicious activities or attacks. 
\section[{d) Disseminations using other hosts}]{d) Disseminations using other hosts}\par
The Botnet spread though the vulnerable hosts, so the Botmaster uses C\&C server to search such a host to become a part of Botnet. 
\section[{IV.}]{IV.}\par
Case Study: IRC Botnet IRC Botnet is the most popular Botnet which uses the centralized mechanism to control the bots. This Botnet uses the IRC channel for communication and controlling the bots. We have tested in a secure environment to avoid infection to other unwanted hosts. When the bot connect to IRC server he/she joins the channel where other users are already login by nicknames. When a user submits the messages to IRC server publically the other user can see her/his messages on the channel \hyperref[b3]{[4]}. IRC include list of channels a user can join any channel though an IRC chat client by channel name.\par
IRC server commonly uses the port 6667 where user gets joined to IRC server. The channel administrator handles all the users. The user can use the commands as follows:\par
1. JOIN: Joins a channel 2. PASS: set or send a password 3. QUIT: Exit a channel 4. SEND: Send the file to another IRC user 5. RAW : Will do the raw scan 6. JUMP: Jump to another IRC server 7. QUIT: Quit the channel a) Experiment Setup Our experiment consists of one IRC server hosted on cloud server with Ubuntu 12.04 and two dummy servers working as bot all are connected in real time Internet environment as shown in following figure \hyperref[fig_1]{1}. We have installed packet capturing tool 'tcpdump' on these servers. The client is installed with Xchat software for joining the channels on IRC server. When the user joins a channel on IRC server, he/she become the channel operator. When the bot is setup on victim's machine from IRC server, the Botmaster tries to hide it's identity from IRC Server by using node commands \hyperref[b3]{[4]}. The user joins the channel by using user name. First we have collected the network traffic with the help of 'tcpdump' and then converted to CSV for further analysis.\par
We have tested the bot to obtain the actual working of bot and Botmaster. In this experiment bots are controlled by using the commands and launch different attacks. The network traffic contains traffic from IRC to bot and other hosts in the network. 
\section[{b) Flow Characteristics}]{b) Flow Characteristics}\par
Our experiment contains over 260000 packets with the flow characteristics shown in below table1. We have filtered this traffic to separate normal or legitimate and Botnet traffic. During the experiment the protocol hierarchy statistics is shown in the following table 2. 
\section[{Name of Field}]{Name of Field}\par
Filed Details  We have tested the bot to obtain the actual working of bot and Botmaster. In this experiment bots are controlled by using the commands and launch  
\section[{Protocol Hierarchy Statistics}]{Protocol Hierarchy Statistics}
\begin{quote}
Flow Characteristics Table 1 :\end{quote}
\begin{figure}[htbp]
\noindent\textbf{2013}\includegraphics[]{image-2.png}
\caption{\label{fig_0}A © 2013}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-3.png}
\caption{\label{fig_1}Figure 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-4.png}
\caption{\label{fig_2}}\end{figure}
  \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.44503184713375793\textwidth}P{0.018407643312101908\textwidth}P{0.12019108280254777\textwidth}P{0.1797452229299363\textwidth}P{0.08662420382165606\textwidth}}
\multicolumn{2}{l}{Source}\tabcellsep \multicolumn{2}{l}{Source IP address}\tabcellsep \\
\multicolumn{2}{l}{Destination}\tabcellsep \multicolumn{2}{l}{Destination IP address}\tabcellsep \\
\multicolumn{2}{l}{Protocol}\tabcellsep \multicolumn{2}{l}{Name of protocol}\tabcellsep \\
\multicolumn{2}{l}{Length}\tabcellsep \multicolumn{2}{l}{Packet Length in bytes}\tabcellsep \\
\tabcellsep Info\tabcellsep \multicolumn{2}{l}{Information about packet}\tabcellsep \\
\tabcellsep Protocol\tabcellsep \tabcellsep \multicolumn{2}{l}{\% Packets Packets}\\
\multicolumn{3}{l}{Transmission Control Protocol}\tabcellsep 54.1 \%\tabcellsep 142640\\
\multicolumn{2}{l}{SSH Protocol}\tabcellsep \tabcellsep 0.10 \%\tabcellsep 270\\
\multicolumn{2}{l}{Internet Relay Chat}\tabcellsep \tabcellsep 7.50 \%\tabcellsep 19748\\
\multicolumn{3}{l}{Virtual Router Redundancy Protocol}\tabcellsep 4.75 \%\tabcellsep 12524\\
\multicolumn{3}{l}{User Datagram Protocol}\tabcellsep 7.38 \%\tabcellsep 19443\\
\multicolumn{2}{l}{Domain Name Service}\tabcellsep \tabcellsep 5.10 \%\tabcellsep 13441\\
\multicolumn{3}{l}{Drop box LAN sync Discovery}\tabcellsep 0.58 \%\tabcellsep 1534\\
Protocol\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{NetBIOS Name Service}\tabcellsep 1.43 \%\tabcellsep 3766\\
\multicolumn{3}{l}{Internet Control Message Protocol}\tabcellsep 0.02 \%\tabcellsep 45\\
IP v6\tabcellsep \tabcellsep \tabcellsep 0.01 \%\tabcellsep 33\\
SMB\tabcellsep \tabcellsep \tabcellsep 0.18 \%\tabcellsep 462\\
Internet\tabcellsep Group\tabcellsep Management\tabcellsep 0.16 \%\tabcellsep 415\\
Protocol\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{Address Resolution Protocol}\tabcellsep 29.20 \%\tabcellsep 76943\\
\multicolumn{2}{l}{Logic-Link Control}\tabcellsep \tabcellsep 2.24 \%\tabcellsep 5907\\
\multicolumn{3}{l}{Spanning Tree Protocol}\tabcellsep 2.17 \%\tabcellsep 5715\\
\multicolumn{3}{l}{Cisco Discovery Protocol}\tabcellsep 0.07 \%\tabcellsep 192\\
IP V6\tabcellsep \tabcellsep \tabcellsep 2.10 \%\tabcellsep 5545\\
DHCP V6\tabcellsep \tabcellsep \tabcellsep 1.18 \%\tabcellsep 3098\\
\multicolumn{2}{l}{Domain Name Service}\tabcellsep \tabcellsep 0.84 \%\tabcellsep 2208\\
HTTP\tabcellsep \tabcellsep \tabcellsep 0.03 \%\tabcellsep 66\\
ICMP v6\tabcellsep \tabcellsep \tabcellsep 0.07 \%\tabcellsep 173\end{longtable} \par
 
\caption{\label{tab_0}Table 2 :}\end{figure}
 			\footnote{© 2013 Global Journals Inc. (US)} 		 		\backmatter  			  				\begin{bibitemlist}{1}
\bibitem[Racine (2004)]{b2}\label{b2} 	 		\textit{Analysis of Internet Relay Chat Usage by DDoS Zombies},  		 			S Racine 		.  		April 2004. Zurich.  		 			Swiss Federal Institute of Technology 		 	 	 (Master's Thesis) 
\bibitem[Overton (2005)]{b3}\label{b3} 	 		‘Bots and Botnet: Risks, Issues and Prevention’.  		 			M Overton 		.  	 	 		\textit{Proceedings of Virus Bulletin Conference},  				 (Virus Bulletin ConferenceDublin, Ireland)  		2005. October 5-7, 2005.  	 
\bibitem[Dittrich and Dietrich ()]{b1}\label{b1} 	 		\textit{P2P as Botnet command and control: a deeper insight},  		 			D Dittrich 		,  		 			S Dietrich 		.  		2008.  		 			Applied Physics Laboratory University of Washington, Computer Science Department Stevens Institute of Technology 		 	 
\bibitem[Symantec and Ware ()]{b0}\label{b0} 	 		 			Symantec 		,  		 			Ware 		.  		 \url{http://www.symantec.com/avcenter/cybercrime/bots\textunderscore page1.html}  		\textit{Bots},  				2008.  	 
\end{bibitemlist}
 			 		 	 
\end{document}
