Indian researchers reveal statistical tool to find hidden zombies in computer networks

A statistical tool to unravel the 'hidden zombie' or computer botnet has been reportedly revealed by Indian researchers that could develop monitoring software and disable the offending malware.

The statistical tool, first known as the hidden semi-Makov model (HsMM), was initially published in 1966 and has now been brought into light by R. Anitha and colleagues at PSG College of Technology, Coimbatore.

The botnet, or a network of computers infected with malware-so-called zombies allow a third party to take control of those machines and a hidden-Markov model includes variables of which the observer has no sight but can infer and so predict an outcome and involves a process where the time-elapsed into the current state affects the prediction.

The researchers applied the statistical logic of the hidden semi-Markov model to forecast the characteristics of internet activity on a given computer suspected of being a "zombie computer" in a botnet based on management information base (MIB) variables.

The approach demonstrated by researchers could model the "normal" behavior and then highlight botnet activity as being a deviation from the normal without the specific variables that are altered by the malware being in plain sight.

If implemented widely, such a system could lock down this kind of botnet very quickly and slow the assimilation of zombie computers by criminals and others with malicious intent.