I am trying to understand the network behavior of bots. Are there any identifiable characteristics of callback requests from the bot to the C&C server which differentiates it from normal traffic? I have learnt of situations where there is a regular callback at a particular time of day,etc. Are there any documented resources which catalog network behavior of bots?
It depends how the botnets communicate:
Most basic botnets will communicate using the old school Internet Relay Chat.
Some applications also communicate using HTTP calls, getting their commands occasionally from one or several control servers
Some botnets use peer-to-peer using sentinels for intermediate control. Distributed botnets have the benefit that they can't be taken down by taking down one controller.
So as you can see there is not just one single protocol that can be used. Most protocols also use custom calls to obfuscate their presence. Remember these bots do not want to be detected.
Yes, some of the current bots still exhibit periodic behaviour but mostly use evading techniques, like introducing noise, to be stealthy and safe from behaviour detection techniques. There are lot of research going on botnet network traffic behaviour. But I did not found yet any single resource which provide summarize behaviour of all the existing bots. if you query for botnet behaviour analysis you find good number of research articles which discuss the traffic behaviour of particular / selected botmalware. below are the some general network traffic characteristics used by different detection techniques to cluster botnet traffic are periodicity ratio of input and output bytes Similarity (in case of more than one botmalware present on the network)