Analysis of Botnet Security Threats

1.1 Introduction

During the last few decades, we have seen the dramatically rise of the Internet and its applications to the point which they have become a critical part of our lives. Internet security in that way has become more and more important to those who use the Internet for work, business, entertainment or education.

Most of the attacks and malicious activities on the Internet are carried out by malicious applications such as Malware, which includes viruses, trojan, worms, and botnets. Botnets become a main source of most of the malicious activities such as scanning, distributed denial-of-service (DDoS) activities, and malicious activities happen across the Internet.

1.2 Botnet Largest Security Threat

A bot is a software code, or a malware that runs automatically on a compromised machine without the user's permission. The bot code is usually written by some criminal groups. The term “bot” refers to the compromised computers in the network. A botnet is essentially a network of bots that are under the control of an attacker (BotMaster). Figure 1.1 illustrates a typical structure of a botnet.

A bot usually take advantage of sophisticated malware techniques. As an example, a bot use some techniques like keylogger to record user private information like password and hide its existence in the system. More importantly, a bot can distribute itself on the internet to increase its scale to form a bot army. Recently, attackers use compromised Web servers to contaminate those who visit the websites through drive-by download [6]. Currently, a botnet contains thousands of bots, but there is some cases that botnet contain several millions of bots [7].

Actually bots differentiate themselves from other kind of worms by their ability to receive commands from attacker remotely [32]. Attacker or better call it botherder control bots through different protocols and structures. The Internet Relay Chat (IRC) protocol is the earliest and still the most commonly used C&C channel at present. HTTP is also used because Http protocol is permitted in most networks. Centralized structure botnets was very successful in the past but now botherders use decentralized structure to avoid single point of failure problem.

Unlike previous malware such as worms, which are used probably for entertaining, botnets are used for real financial abuse. Actually Botnets can cause many problems as some of them listed below:

i. Click fraud. A botmaster can easily profit by forcing the bots to click on advertisement for the purpose of personal or commercial abuse.

ii. Spam production. Majority of the email on the internet is spam.

iii. DDoS attacks. A bot army can be commanded to begin a distributed denial-of-service attack against any machine.

iv. Phishing. Botnets are widely used to host malicious phishing sites. Criminals usually send spam messages to deceive users to visit their forged web sites, so that they can obtain users' critical information such as usernames, passwords.

1.3 Botnet in-Depth

Nowadays, the most serious manifestation of advanced malware is Botnet. To make distinction between Botnet and other kinds of malware, the concepts of Botnet have to understand. For a better understanding of Botnet, two important terms, Bot and BotMaster have been defined from another point of views.

Bot - Bot is actually short for robot which is also called as Zombie. It is a new type of malware [24] installed into a compromised computer which can be controlled remotely by BotMaster for executing some orders through the received commands. After the Bot code has been installed into the compromised computers, the computer becomes a Bot or Zombie [25]. Contrary to existing malware such as virus and worm which their main activities focus on attacking the infecting host, bots can receive commands from BotMaster and are used in distributed attack platform.

BotMaster - BotMaster is also known as BotHerder, is a person or a group of person which control remote Bots. Botnets- Botnets are networks consisting of large number of Bots. Botnets are created by the BotMaster to setup a private communication infrastructure which can be used for malicious activities such as Distributed Denial-of-Service (DDoS), sending large amount of SPAM or phishing mails, and other nefarious purpose [26, 27, 28]. Bots infect a person's computer in many ways.

Bots usually disseminate themselves across the Internet by looking for vulnerable and unprotected computers to infect. When they find an unprotected computer, they infect it and then send a report to the BotMaster. The Bot stay hidden until they are announced by their BotMaster to perform an attack or task. Other ways in which attackers use to infect a computer in the Internet with Bot include sending email and using malicious websites, but common way is searching the Internet to look for vulnerable and unprotected computers [29]. The activities associated with Botnet can be classified into three parts: (1) Searching - searching for vulnerable and unprotected computers. (2) Dissemination - the Bot code is distributed to the computers (targets), so the targets become Bots. (3) sign-on - the Bots connect to BotMaster and become ready to receive command and control traffic.

The main difference between Botnet and other kind of malwares is the existence of Command-and-Control (C&C) infrastructure. The C&C allows Bots to receive commands and malicious capabilities, as devoted by BotMaster. BotMaster must ensure that their C&C infrastructure is sufficiently robust to manage thousands of distributed Bots across the globe, as well as resisting any attempts to shutdown the Botnets. However, detection and mitigation techniques against Botnets have been increased [30,31]. Recently, attackers are also continually improving their approaches to protect their Botnets. The first generation of Botnets utilized the IRC (Internet Relay Chat) channels as their Common-and-Control (C&C) centers. The centralized C&C mechanism of such Botnet has made them vulnerable to being detected and disabled. Therefore, new generation of Botnet which can hide their C&C communication have emerged, Peer-to-Peer (P2P) based Botnets. The P2P Botnets do not experience from a single point of failure, because they do not have centralized C&C servers [35]. Attackers have accordingly developed a range of strategies and techniques to protect their C&C infrastructure.

Therefore, considering the C&C function gives better understanding of Botnet and help defenders to design proper detection or mitigation techniques. According to the C&C channel we categorize Botnets into three different topologies: a) Centralized; b) Decentralized and c) Hybrid. In Section 1.1.4, these topologies have been analyzed and completely considered the protocols that are currently being used in each model.

1.4 Botnet Topologies

According to the Command-and-Control(C&C) channel, Botnet topology is categorized into three different models, the Centralized model, the Decentralized model and Hybrid model.

1.4.1 Centralized Model

The oldest type of topology is the centralized model. In this model, one central point is responsible for exchanging commands and data between the BotMaster and Bots. In this model, BotMaster chooses a host (usually high bandwidth computer) to be the central point (Command-and-Control) server of all the Bots. The C&C server runs certain network services such as IRC or HTTP. The main advantage of this model is small message latency which cause BotMaster easily arranges Botnet and launch attacks.

Since all connections happen through the C&C server, therefore, the C&C is a critical point in this model. In other words, C&C server is the weak point in this model. If somebody manages to discover and eliminates the C&C server, the entire Botnet will be worthless and ineffective. Thus, it becomes the main drawback of this model. A lot of modern centralized Botnets employed a list of IP addresses of alternative C&C servers, which will be used in case a C&C server discovered and has been taken offline.

Since IRC and HTTP are two common protocols that C&C server uses for communication, we consider Botnets in this model based on IRC and HTTP. Figure 1.2 shows the basic communication architecture for a Centralized model. There are two central points that forward commands and data between the BotMaster and his Bots. Botnets based on IRC

The IRC is a type of real-time Internet text messaging or synchronous conferencing [36]. IRC protocol is based on the Client Server model that can be used on many computers in distributed networks. Some advantages which made IRC protocol widely being used in remote communication for Botnets are: (i) low latency communication; (ii) anonymous real-time communication; (iii) ability of Group (many-to-many) and Private (one-to-one) communication; (iv) simple to setup and (v) simple commands. The basic commands are connect to servers, join channels and post messages in the channels; (vi) very flexibility in communication. Therefore IRC protocol is still the most popular protocol being used in Botnet communication.

In this model, BotMasters can command all of their Bots or command a few of the Bots using one-to-one communication. The C&C server runs IRC service that is the same with other standard IRC service. Most of the time BotMaster creates a channel on the IRC server that all the bots can connect, which instruct each connected bot to do the BotMaster's commands. Figure 1.3 showed that there is one central IRC server that forwards commands and data between the BotMaster and his Bots.

Puri [38] presented the procedures and mechanism of Botnet based on IRC, as shown in Figure. 1.4.

Bots infection and control process [38]:

i. The attacker tries to infect the targets with Bots.

ii. After the Bot is installed on target machine, it will try to connect to IRC server. In this while a random nickname will be generate that show the bot in attacker's private channel.

iii. Request to the DNS server, dynamic mapping IRC server's IP address.

iv. The Bot will join the private IRC channel set up by the attacker and wait for instructions from the attacker. Most of these private IRC channel is set as the encrypted mode.

v. Attacker sends attack instruction in private IRC channel.

vi. The attacker tries to connect to private IRC channel and send the authentication password.

vii. Bots receive instructions and launch attacks such as DDoS attacks. Botnet based on HTTP

The HTTP protocol is an additional well-known protocol used by Botnets. Because IRC protocol within Botnets became well-known, internet security researchers gave more consideration to monitoring IRC traffic to detect Botnet. Consequently, attackers started to use HTTP protocol as a Command-and-Control communication channel to make Botnets become more difficult to detect. The main advantage of using the HTTP protocol is hiding Botnets traffics in normal web traffics, so it can easily passes firewalls and avoid IDS detection. Usually firewalls block incoming and outgoing traffic to not needed ports, which usually include the IRC port.

1.4.2 Decentralized model

Due to major disadvantage of Centralized model-Central Command-and-Control (C&C)-attackers tried to build another Botnet communication topology that is harder to discover and to destroy. Hence, they decided to find a model in which the communication system does not heavily depending on few selected servers and even discovering and destroying a number of Bots.

As a result, attackers take advantage of Peer-to-Peer (P2P) communication as a Command-and-Control (C&C) pattern which is much harder to shut down in the network. The P2P based C&C model will be used considerably in Botnets in the future, and definitely Botnets that use P2P based C&C model impose much bigger challenge for defense of networks.

In the P2P model, as shown in Fig. 1.6, there is no Centralized point for communication. Each Bot have some connections to the other Bots of the same Botnet and Bots act as both Clients and servers. A new Bot must know some addresses of the Botnet to connect there. If Bots in the Botnet are taken offline, the Botnet can still continue to operate under the control of BotMaster.

P2P Botnets aim at removing or hiding the central point of failure which is the main weakness and vulnerability of Centralized model. Some P2P Botnets operate to a certain extent decentralized and some completely decentralized. Those Botnets that are completely decentralized allow a BotMaster to insert a command into any Bots. Since P2P Botnets usually allow commands to be injected at any node in the network, the authentication of commands become essential to prevent other nodes from injecting incorrect commands.

For a better understanding in this model, some characteristics and important features of famous P2P Botnets have been mentioned:
Slapper: Allows the routing of commands to distinct nodes. Uses Public key and private key cryptography to authenticate commands. BotMasters sign commands with private key and only those nodes which has corresponding public key can verify the commands [42]. Two important weak points are: (a) its list of known Bots contains all (or almost all) of the Botnet. Thus, one single captured Bot would expose the entire Botnet to defenders [42] (b) its sophisticated communication mechanism produces lot traffic, making it vulnerable to monitoring via network flow analysis.
Sinit: This Bot uses random searching to discove other Bots to communicate with. It can results in an easy detection due to the extensive probing traffic [34].
Nugache: Its weakness is based on its reliance on a seed list of 22 IP addresses during its bootstrap process [47].
Phatbot: Uses Gnutella cache server for its bootstrap process which can be easily shutdown. Also its WASTE P2P protocol has a scalability problem across a long network [48].
Strom worm: it uses a P2p overnet protocl to control compromised hosts. The communication protocol for this Bot can be classified into five steps, as describes below :[37]
i. Connect to Overnet - Bots try to join Overnet network. Each Bot initially has hard-coded binary files which is included the IP addresses of P2P-based Botnet nodes.
ii. Search and Download Secondary Injection URL - Bot uses hard-coded keys to explore for and download the URL on the Overnet network [37].
iii. Decrypt Secondary Injection URL - compromised hosts take advantages of a key(hard coded) to decrypt the URL.
iv. Download Secondary Injection - compromised hosts attempt to download the second injection from a server(probably web server). It could be infected files or updated files or list of the P2P nodes [37].

1.4.3 Hybrid model

The Bots in the Hybrid Botnet are categorized into two groups:

1) Servant Bots - Bots in the first group are called as servant Bots, because they behave as both clients and servers, which have static, routable IP addresses and are accessible from the entire Internet.

2) Client Bots - Bots in the second group is called as client Bots since they do not accept incoming connections. This group contains the remaining Bots, including:- (a) Bots with dynamically designated IP addresses; (b) Bots with Non-routable IP addresses; and (c) Bots behind firewalls which they cannot be connected from the global Internet.

1.5 Background of the Problem

Botnets which are controlled remotely by BotMasters can launch huge denial of service attacks, several infiltration attacks, can be used to spread spam and also conduct malicious activities [115]. While bot army activity has, so far, been limited to criminal activity, their potential for causing large- scale damage to the entire internet is immeasurable [115]. Therefore, Botnets are one of the most dangerous types of network-based attack today because they involve the use of very large, synchronized groups of hosts for their malicious activities.

Botnets obtain their power by size, both in their increasing bandwidth and in their reach. As mentioned before Botnets can cause severe network disruptions through huge denial- of-service attacks, and the danger of this interruption can charge enterprises big sums in extortion fees. Botnets are also used to harvest personal, corporate, or government sensitive information for sale on a blooming organized crime market.

1.6 Statement of the Problem

Recently, botnets are using new type of command-and-control(C&C) communication which is totally decentralized. They utilize peer-to-peer style communication. Tracking the starting point and activity of this botnet is much more complicated due to the Peer-to-Peer communication infrastructure.

Combating botnets is usually an issue of discovering their weakness: their central position of command, or C&C server. This is typically an IRC network that all bots connect to central point, however with the use of P2P method; we cannot find any central point of command. In the P2P networks each bots in searching to connect other peers which can receive or broadcast commands through network. Therefore, an accurate detection and fighting method is required to prevent or stop such dangerous networks.

1.7 Research Questions

a. What are the main differences between centralized and decentralized botnets?

b. What is the best and efficient general extensible solution for detecting non-specific Peer-to- Peer botnets?

1.8 Objectives of the Study

i. To develop a network-based framework for Peer-to-Peer botnets detection by common behavior in network communication.

ii. To study the behavior of bots and recognizing behavioral similarities across multiple bots in order to develop mentioned framework.

1.9 Scope of the Study

The project scope is limited to developing some algorithms pertaining to our proposed framework. This algorithms are using for decreasing traffics by filtering it, classifying intended traffics, monitoring traffics and the detection of malicious activities.

1.10 Significance of the study

Peer-to-Peer botnets are one of the most sophisticated types of cyber crime today. They give the full control of many computers around to world to exploit them for malicious activities purpose such as spread of virus and worm, spam distribution and DDoS attack. Therefore, studying the behavior of P2P botnets and develop a technique that can detect them is important and high-demanded.

1.11 Summary

Understanding the Botnet Command-and-Control(C&C) is a critical part in recognizing how to best protect against the overall botnet threat. The C&C channels utilized by the Botnets will often show the type and degree of actions an enterprise can follow in either blocking or shutting down a botnet, and the probability of success.

It is also obvious that attackers have been trying for years to move away from Centralized C&C channels, and are achieving some success using Decentralized(P2P) C&C channels over the last 5 or so years. Therefore in this chapter we have defined a classification for better understanding of Botnets C&C channels, which is included Centralized, Decentralized, and Hybrid model and tried to evaluate recognized protocols in each of them. Understanding the communication topologies in Botnets is essential to precisely identify, detect and mitigate the ever-increasing Botnets threats.

2.1 Introduction

Before majority of botnets was using IRC (Internet Relay Chat) as a communication protocol for Command and Control(C&C) mechanism. Therefore, many researches tried to develop botnet detection scheme which was based on analysis of IRC traffic [50]. As a result, attackers decided to develop more sophisticated botnets, such as Storm worm and Nugache toward the utilization of P2P networks for C&C infrastructures. In response to this movement, researches have proposed various models of botnets detection that are based on P2P infrastructure [5].

One key advantage of both IRC and HTTP Botnet is the use of central Command and Control. This characteristic provides the attacker with very well-organized communication. However, the assets also considers as a main disadvantage to the attacker [8]. The threat of the Botnet can be decreased and possibly omitted if the central C&C is taken over or taken down [8]. The method that is starting to come out is P2P structure for Botnet interaction. There is not any centralized centre for P2P botnets. Any nodes in P2P botnet behave as client and server as well. If any point in the network is shut down the botnet still can continue its operation.

The storm botnet is one of the main and recognized recent P2P botnets. It customized the overnet P2P file-sharing application which is based on the Kademlia distributed hash table algorithm [55] and exploit it for its C&C infrastructure. Recently many researchers specially in the anti-virus community and electronic media concentrated on storm worm [56,57].

2.2 Background and History

A peer-to-peer network is a network of computers that any computer in the network can behave as both a client and a server.

Some explanation of peer-to-peer networks does not need any form of centralized coordination. This definition is more comfortable because the attacker may be interested in hybrid architectures [8].

2.2.1 History

The table 2.1 shows a summary of some well-known bots and P2P protocols. The range of time from the first bots, EggDrop, until the Storm Worm P2P bot is newly released. The first non-malicious bot was EggDrop that came up many years ago, and we know it as one of the first IRC bots that came to market. GTBot that have many other categories is another well-known malicious bot, that its variants are IRC client, mIRC.exe[61].

After a while, P2P protocols have been used for Botnet activities. Napster is one of the first bot that used P2P as its communication. Napster built an platform that permit all bots can find each other and share files with each other in the network. In this bot, file sharing has been done in the centralized server that we can say it was not completely a P2P botnet. Therefore, all bots have to upload an index of their files to the centralized server and also if they are looking for other files among all bots, have to search in centralized server. If it can find any file that looking for, then can directly connect to that bot and download what they want. Nowadays, because Napster has been shutdown as their service recognized as illegal service, many other P2P service focusing on avoiding such finding.

After few years after Napster, Gnutella protocol came up as the first completely P2P services. Actually after Gnutellas , as shown in Table 2.1, many other P2P protocols have been released, such as Kademilia and Chord. This two new p2p service are using distributed hash table as a method for finding information in the peer-to-peer networks.

Agobot is another malicious P2P bot that came up recently and become widespread because of good design and modular code base [61]. Nowadays many researchers are concentrating on P2P bots and there is an anticipation that P2P bots will reach to the stage that Centralized botnets will not been used any more in the future.

Table 2.1: P2P based Botnets

2.3 Peers-to-Peer Overlay Networks

Overlay networks are categorized into two categories: Structured and Unstructured. All nodes in first category can connect to most X peers regarding some conditions for identification of nodes that those peers want to connect. However in unstructured type there is not any specified limit for the number of peers that they can connect, in spite of the fact that there is not any condition for connecting to other peers. Overnet is a good example of structured p2p networks and Chorf is a good example of unstructured P2P networks.

2.3.1 Brief overview of Overnet

One of the popular file sharing networks is Overnet that use for their design use distributed hash table (DHT) algorithm that called Kademlia[55]. Each node produces a 128-bit id for joining the network and also use for sending to other node for introducing itself. Actually each node in the network saves the information about other nodes in order to route query messages.

2.3.2 Brief overview of Gnutella

Gnutellas is a unstructured file sharing network. In this network, when a node like n want to connect to a node like m, use a ping message to inform the other node for its presence. As long as node m received ping message, then send it back to other nodes in its neighbor and also send a Pong message to the sender of ping message that was node n. this transaction among node let them to learn about each other.

2.4 Botnet Detection

In particular, to compare existing botnet detection techniques, different methods are described and then disadvantages of each method are mentioned respectively.

2.4.1 Honeypot-based tracking

Honeypot can be used to collect bots for analyzing its behavior and signatures and also for tracking botnets. But using honeypots have several limitations. The most important limitation is because of limited scale of exploited activities that can track. And also it cannot capture the bots that use the method of propagation other than scanning, such as spam. And finally it can only give report for infection machines that are anticipated and put in the network as trap system. So it means that it can not give a report for those computers that are infected with bot in the network but are not devoted as trap machines. So we can come to this conclusion that generally in this technique we have to wait until one bot in the network infect our system and then we can track or analyze the machine.

2.4.2 Intrusion detection systems

Intrusion detection techniques can be categorized into two categories: host-based and network-based solution. Host-based techniques are used for recognizing malware binaries such as viruses. A good example of this type is anti-virus detection systems. However, we know that anti-virus are good for just virus detection. The most important disadvantages of anti-virus are that bots can easily evade the detection technique by changing their signatures easily, because the detection system cannot update their databases consistency. And also bots can disable any anti-virus tools in the system to protect themselves from detection.

Network- based intrusion detection system is another method for detection that is used in the field of botnet detection. Snort[67] and Bro[68] are the two well-known signature based detection system that are used currently. They use a database as signatures of famous malicious activities to detect botnets or any other malware. Actually if our objective is using this technique for botnet detection, we have to keep updating the database and recognizing all malware quickly to make a signature of it and add to our database. For solving this solving this problem recently researchers are using anomaly based IDS that can detect malicious activities based on behavior of malware or detection techniques.

2.4.3 Bothunter : Dialog correlation-based Botnet detection

This technique developed an evidence-trail approach for detecting successful bot infection with patterns during communication for infection process. In this strategy, bot infection pattern are modeled to use for recognizing the whole process of infection of botnet in the network. All behavior that occur the bot infection such as target scanning, C&C establishment, binary downloading and outbound propagation have to model by this method. This method gathers an evidence-trail of connected infection process for each internal machine and then tries to look for a threshold combination of sequences that will convince the condition for bot infection [32].

The BotHunter use snort with adding two anomaly-detection components to it that are SLADE (Statistical payLoad Anomaly Detection Engine) and SCADE (Statistical scan Anomaly Detection Engine). SCADE produce internal and external scan detection warnings that are weighted for criticality toward malware scanning patterns. SLADE perform a byte-distribution payload anomaly detection of incoming packets, providing a matching non-signature approach in inbound exploit detection [32 ].

Slade use an n-gram payload examination of traffics that have typical malware intrusions. SCADE execute some port scan analysis for incoming and outgoing traffics. Actually BotHunter has a link between scan and alarm intrusion that shows a host has been infected. When a adequate sequence of alerts is established to match BotHunter's infection dialog model, a comprehensive report is created to get all the related events participants that have a rule in infection dialog [32]. This method provides some important features:

i. This technique concentrates on malware detection by IDS-driven dialog correlation. This model shows an essential network processes that occur during a successful bot infection.

ii. This technique has one IDS-independent dialog correlation engine and three bot-specific sensors. This technique can automatically produce a report of whole detection of bot, as well as the infection of agent, identification of the computer that has been infected and source of Command and Control centre. Bot infection sequences

Actually understanding bot infection life processes is a challenging work for protection of network in the future. The major work in this area is differentiating between successful bot infection and background exploit attempt. For reaching to this point analysis of two-way dialog flow between internal hosts and external hosts (internet) is needed. In a good design network which uses filtering at gateway, the threats of direct exploitations are limited. However, contemporary malware families are highly flexible in their ability to attack vulnerable hosts through email attachments, infected P2P media, and drive-by download infections [32]. Modeling the infection dialog process

The bot distribution model can conclude by an analysis of external communication traffics that shows the behavior of relevant botnet. Incoming scan and utilize alarms are not enough to state a winning malware infection, as are assumed that a stable stream of scan and exploit signals will be observed from the way out monitor [32].

Figure 2.1 shows the process of bot infection in BotHunter that used for evaluating network flows through eight stages. This model is almost similar with the model that Rajab et al. presented for IRC detection model. The model that they proposed has early initial scanning that is a preceding consideration happen in form of IP exchange and pointing vulnerable ports. Actually figure 2.1 is not aimed for a strict ordering of infection events that happen during bot infection.

The important issue here is that bot dialog processes analysis have to be strong to the absence of some dialog events and must not need strong sequencing on the order in bound dialog is conducted. One solution to solve the problem of sequence order and event is to use a weighted event threshold system that take smallest essential sparse sequences of events under which bot profile statement can be initiated [32]. For instance, it is possible put weighting and threshold system for the look of each event in a way that a smallest set of event is important prior of bot detection. Design and implementation

More attention devoted for designing a passive network monitoring system in this part which be able of identifying the bidirectional warning signs when internal hosts are infected with bots. Actually BotHunter is composed of some IDS components that fully inspect internal and external traffic flows and have a correlation engine that produce a good image of bot infection in the network. The point that is significant in this part is location of BotHunter that has to be at gateway of network that can fully receive all communication packets that take place between the internal hosts and the Internet. The IDS components are based on the snort which is an open source tools. This model use snort's signature engine.

2.4.4 BotMiner: structure independent Botnet detection

This model tried to more focus on distributed structures like peer-to-peer, however still is applicable for centralized structures such as IRC and HTTP. Actually this model is based on parallel correlation for its detection approaches that aiming to discover the machines that joined botnet. Based on the statistics [98], almost 53% of botnet activity commands in some way are associated to scan, the usually are used for dissemination purpose and almost 14.4% are related to binary downloading that are used for malware updating. The word controlled here actually is referring to bots that have to contact their command and control servers to get commands to perform their malicious activities. It means that there is communication between bots and command and control servers. Also the word Coordinated group means that several bots in the same botnet will execute similar communication and malicious activities. It means that if botherder orders every bot alone by using different commands and channel, then the bots are just unrelated infection machines.

This model has been designed based on the botnet definition that described above. BotMiner actually monitors two important activities: who is communicating with whom and who is performing what activities, and try to find a coordinated group pattern in both kinds of activities. This model categorizes identical communication activities in the C-plane( the traffic of command and control communication), categorizes identical malicious activities in the A-plane( activity traffic) and executing cross-cluster correlation to discover the computers that share identical communication patterns and malicious activity patterns. The well-known aspects of this model are:

i. Firstly this model has not design for special kind of protocols and is applicable for both centralized and decentralized structures, and more importantly this model do not need to know about command and control addresses or signatures of botnets.

ii. This model is independent of the content of command and control communication, and can very accurately classify identical command and control traffic patterns. Some disadvantages

In order for a botherder to order their bots for some malicious activities, the existence of command and control channel that bots can receive commands are initiate attacks are investable. Actually the existence of command and control channel is necessary if bots want to form a botnet. The IRC protocol is an old kind of communication among bots. In this protocol, every bots have to log into IRC channel and look for commands from botherders. Still many botnets around the world are using IRC channel as a platform for communication.

Recently botnets have been started to use other kind of protocols for their communication. The reason that attacker changed their intrest from IRC to Http protocol is that Http protocol are allowed in majority of networks. However, centralized command and control structure is effective but they have serious disadvantages which is single point of failure. It means that if IRC server or web server that control botnets is shutdown because of some detection systems, the whole botnet will shutdown, because the botnet loses its command and control structures and become a group of isolated machines that don't have any power to attack as before.

Recently, botherder started to change their structure from centralized to decentralized to avoid the serious problem that centralized have. Therefore, peer-to-peer communication has been used recently for communication among bots. As an example Storm worm and Nugache are two well-known p2p botnets that recently came up and infected many machines around the world.

Based on the botnet definition that described previously (“the group of bots in the same botnet will show similar communication and malicious activities”) a botnet characterized by its command and control communication channel and malicious activities that they execute. There are some other kind of malware like worms that execute some malicious activities but we don't consider them as botnet, since they do not connect to command and control channel. At the other hand there are some IRC clients and P2P file sharing tools like Bittorent that have analogous communication pattern to botnets, however they do not execute malicious activities.

Actually members of same botnet, centralized or decentralized, are communicate with each other through the command and control channel. It means that despite of architecture of botnet, command and control channel play a key role in communicating of botnets. There are some rare cases that botnets don't need command and control channel, or better say they are isolated bost. This technique strongly is based on this point that bots in the same botnet perform similar synchronized activities. Botnet architecture

Actually in this model two traffic monitoring have been installed at the edge of the network for inspection of traffic between internal and external network which is C-plane and A-plane. They are working in parallel to each other and monitoring network traffics. The first one which is C-plane is designed for logging communication flows in a format that can easily and simply analyze and store. The A-plane is accountable to discover suspicious activities that happen and commonly in each network, like scanning, spamming and exploit attempts. At the next step, the c-plane clustering and A-plane clustering components examine the logs that produced at previous stages. Actually both components pull out some information from the logs and then executing clustering algorithms to discover groups of hosts that show analogous communication and activity patterns. At the end, cross-plane correlator mixes the results of the c-plane and A-plane clustering and decides which compromised computers are the members of botnets. In a very perfect situation, the traffic monitors have to distribute on different area on the internet and then the logs that they produce are sent to central repository centre for further inspection and analysis. Traffic monitors

C-plane Monitor. This component capture the network flows and records the useful information on the machines that have communication with each other. This component takes the advantage of fcapture tool. Each record has some information to record like source ip, destination ip. The main privilege of this tool is that it works at very high speed networks (new generation of networks are very high speed) and can produce very compact records for further inspection and processes by C-plane clustering module.

A-plane Monitor. This component logs information on each machine job to understand what they are doing. It mainly examines the traffics that going out from internal network and is able to discover malicious activities that the interior machines may execute. This component is capable to spot scanning activities, spamming, binary downloading and exploit attempts.

2.5 Summary

A P2P botnet is a network of compromised computers (i.e., bots) that are under the control of an attacker (i.e., a botmaster) through some command and control (C&C) channel and is completely decentralized. It typically contains thousands of bots, however some even have several millions of bots. Botnets are now used for many malicious activities such as DDoS attacks, spam and phishing. With the scale and the strength of attacks applicable by their united bandwidth and processing power, botnets and specially P2P are now measured as the main risk to Internet security. We analyzed the previous work on detection of P2P botnet and mainly analyzed Bothunter and Botminer that is more important in this area.

3.1 Introduction

After examining many and various Botnets detection techniques, the analysis of literature and review of previous attempts to create botnets detection, the need for further research focusing on botnets and conditions that needs in higher education level is evident.

In this chapter, the main plan of how to develop the new framework for detecting botnet will be explained. It is quite important to outline the whole plan in order to make sure that the progress of the project will not divert from its main objective and the outcome can be achieved in desirable way.

3.2 Research Approach

There are two methods to evaluate whether the research result is compatible with the requirements or not which are Qualitative and Quantitative approaches.

3.2.1 Qualitative Approach

This approach consist a complete understanding of manners and the justification that control behavior. This approach is based on reason behind various aspects of behavior and actually these characteristics differentiate it from quantitative approach. It analyze the how and why of taking decision that if compare to qualitative research we can see what, where and when of decision making. Wikipedia.

3.2.2 Quantitative Approach

Quantitative method is facing with numbers and anything that is calculable. Consequently, they have to be distinguished from qualitative methods. Counting and measuring are common forms of quantitative methods. The outcome of the research is a figure, or a series of figures. These are frequently presents in tables, graphs or other form of statistics, Wikipedia.

Quantitative research is broadly used in both the natural and social sciences, including sociology, physics, psychology, biology, geology, education and journalism. Quantitative research is usually using technical methods which include, Wikipedia.

1- The creation of models, theories and hypotheses

2- The advance of instruments and methods for measurement

3- Experimental control and manipulation of variables

4- Gathering of experimental data

5- Modeling and study of data

6- Assessment of results.

There are some differences between qualitative and quantitative research approaches as shown in Table3.1.

Table 3.1: Qualitative and Quantitative Differences

Qualitative approach

Quantitative approach

Develops theory

Develops theory and tests

theory as well.

Describes meaning or discovery

Establishes relationship or causation

uses communication and

Uses instruments

Uses unstructured data collection

Uses structured data collection

3.3 Research Strategy

In any research, gathering the necessary information, verifying requirements and method are very important steps to complete the project and get the expected results. The methods that researchers are usually used are:

1- Document retrieval method.

2- Comparative study method.

3.3.1 Document Retrieval Method

Document retrieval is explained as the corresponding of some confirmed user query in opposition to a set of free-text records. It is possible that mentioned records be any form of mostly unstructured text, real estate records or paragraphs in a manual. Wikipedia.

Document retrieval system locates information to a specified condition by matching text records (documents) against user demands, as opposed to expert systems that answer questions by inferring over a logical knowledge database. A document retrieval system includes a file of documents, a categorization algorithm to create a full text directory, and a user interface to access the directory. A document retrieval system has two main tasks :( Wikipedia)

1 - Find relevant documents to user queries.

2 - Evaluate the matching results and sort them according to relevance, using some algorithms.

3.3.2 Comparison Study Method

In comparative study, the items are specimens or cases which are alike in some features (it means that they are essential for comparison) however they could be different in some area. These differences become the focal point of examination. The goal is to find out why the cases are different, Wikipedia.

Comparative research's design is very easy. The comparative method does not need any earlier model or theory to start with. Therefore, it is a good method that researchers do investigative studies at first and then try to progress from the preliminary level of case study to a sophisticated and advanced level of theoretical invariance. In this project, the comparative studies based on literature reviews have been used. As we mentioned in chapter2, many similar frameworks and detection algorithms have been analyzed completely.

3.4 Overview of Methodology

Figure 3.1 display the structural design of our proposed botnet detection method which consists of four main components: Filtering, Application Classifier, Traffic Monitoring and Malicious Activity Detector. Filtering is responsible to decrease traffic flows. The main benefit of this stage is reducing the traffic workload and makes application classifier work properly. Application classifier is responsible for separating IRC and HTTP traffics from the rest of traffics. Malicious activity detector is responsible to analyze the traffics carefully and try to detect malicious activities that internal host may perform and separate those hosts and send to next stage. Traffic Monitoring is responsible to detect the group of hosts that have similar behavior and communication pattern by inspecting network traffics. Analyzer is a simple component that is responsible for comparing the results of previous parts (Traffic Monitoring and Malicious Activity Detector) and finding hosts that are common on the results of both lists.

Network Traffics

Application Classifier

IRC & HTTP traffics

Peer-to-Peer traffics

Traffic Monitor

Malicious Detector

3.4.1 Filtering

The main benefit of this stage is decreasing the traffic workload and makes application classifier process more efficient. For this purpose many solution could be used. For example, We also can filter the traffic which destination IPs are well-known like Google, Yahoo, MSN, and many other famous web servers around world.

3.4.1 Application classifier

Classifying the traffic of network into diverse application is a complicated job and is an hard issue that many researchers are focusing on it. The classification of traffics mainly is based on port numbers, which was an efficient way before. However, because of increase in applications that uses tunneling through Http and also emergence of p2p, port numbers are no longer effective in this area.

Because recognizing suspicious HTTP and IRC traffic is quite simple we can first separate traffics which have these protocols and then send the rest of the traffics to the traffic monitoring stage.

3.4.2 Traffic monitoring

The log flow stage records all information related to headers of packets which we need. The information that we have to records from network flows in mainly depend on the behaviors that we want to monitor and the target that we are looking for. Based on some initial findings and evaluating similar works in this context we think that source IP, destination port, destination IP and mostly the amount of packets and bytes that are transferred might be a good option.

3.4.3 Malicious activity detector

It analyzes the traffics carefully and tries to detect malicious activities that internal hosts may perform. It is more sophisticated process in comparison to other stages. The system have to be able of discovering at least very famous malicious activities like scanning, binary downloading and spam.

3.4.4 Analysis

This stage has to analyze completely the output of previous stages (traffic monitoring and malicious activity detector).

3.5 Limitation of Research

There are several limitations for this research. The most noticeable limitation relates to not access to sample of P2P based botnets. In order to inspect the behavior of botnet in network, we need to install P2P botnet in the network which due to high risk of its unexpected behavior, currently is impossible and even it is unlikely to access to the gateway of big network like university for analyzing the incoming traffics.

3.6 Summary

In this chapter we reviewed the proposed algorithm for P2P botnet detection. The important stage of this technique has been analyzed briefly in this chapter. Our proposed method is based on common behavior in network communication. It is an extendable technique which can be improved for finding Centralized botnet as well.

4.1 Introduction

This chapter has been written in order to complete the related literature review and mentioned objective in chapter one. In addition, scenario method analyses with respect to related analysis been studied.

4.2 Botnet Detection Framework and Components

Our proposed a framework is based on common behavior in network communication. This model is based on the definition of P2P botnets that several bots inside the same botnet will demonstrate analogous command and control communication patterns and analogous malicious activity patterns. We share almost similar idea for definition of botnet as proposed by Gu et al. in Botminer [38], however many other researchers' detection model is based on the same definition of Botnet.

Figure 4.1 illustrates the structural design of our proposed Botnet detection system including of four core components: Filtering, Application Classifier, Traffic Monitoring, Malicious Activity Detector and one small component which is analyzer.

4.2.1 Filtering:

The main objective of this part is to decrease the traffic workload and makes the rest of the system perform more powerfully. The location that we have to filter out network traffics is at the gateway of network. Figure 4.2 show the proper location that our system has to use in order to filter out efficiently. We have to use this filtering system at the gateway of network.

In C1, we filter those traffics which targets (destination IP address) are recognized servers and will very rarely host botnet C&C servers. For this purpose we used the top 500 websites on the web (Http://www.alexa.com/topsites), which the top 3 are google.com, facebook.com and yahoo.com. In C2, we filter handshaking processes traffics (connection establishments) that are not completely established. Handshaking is the process of initial negotiation that automatically sets some parameters for a communication channel between two parties prior normal communication happen. It follows the physical establishment of the channel and precedes normal information transfer [106]. A good example that usually we face with that in network is TCP protocol operations. To establish a connection, TCP uses a three-way handshake; in this case we filter out the traffics that TCP handshaking have not completed. Like a host sends SYN packets without completing the TCP handshake. Based on our experience these flows are mostly caused by scanning activities. Figure 4.3 illustrate the stages of our filtering system.

4.2.2 Application Classifier

Application Classifier is responsible to separate IRC and HTTP traffics from the rest of traffics and send them to Centralized part. For detecting IRC traffics we can inspect the contents of each packet and try to match the data against a set of user defined strings. For this purpose we use payload inspection that only inspects the first few bytes of the payload and looking for specific strings. These IRC specific strings are NICK for the client's nickname, PASS for a password, USER for the username, JOIN for joining a channel, OPER that says a regular user wants to become a channel operator and PRIVMSG that says the message is a private message.[107] Using this strategy for detecting IRC traffic is almost simple, as shown in figure 4.4.

In next step, we also have to separate Http traffics and send to Centralized part. For this purpose we also can inspect the first few bytes of Http request and if it has certain pattern or strings, separate it and send it to centralized part. For detecting Http traffics we focus on concept of Http protocol. HTTP uses the client-server model: An HTTP client start a link and sends a message to an HTTP server (e.g. "Get me the file 'home.html'"); the server send back a reply message, frequently the resource that was requested("Here's the file", followed by the file itself). After sending the response, the server terminates the connection. [108]

In the format of Http request message, we are focusing on Http methods. Three common Http methods are “GET”, “HEAD”, or “POST”: [108]

i. A GET is the most familiar Http method; it says "give me this file".

ii. A HEAD request is alike to GET request, apart from it just asks the server to send back the reply headers.

iii. A POST request is utilized to send data to the server.

Therefore we inspect the traffics and if the first few bytes of an Http request contain “GET”, “POST” or “HEAP”, it's the indication of Http protocol and will separate those flows and send them to Centralized part, as shown in figure 4.5. After filtering out Http and IRC traffics, the remaining traffics that have the probability of containing P2P traffics are send to Traffic Monitoring part and Malicious Activity Detector. However in parallel we can use other approaches for identifying P2P traffics. We have to take into consideration that P2P traffic is one of complicated application type. Payload-based classification approaches customized to p2p traffic have been presented in [109, 110], while identification of p2p traffic through transport layer characteristics is proposed in [111]. Our suggestion for using specific application or tools for identifying P2P traffics other than sending remaining traffics is use of BLINC [112] that can identify general P2P traffics. BLINC is based on recognizing host behavior at transport layer. This method has two well-known aspects. First, it can operate in a situation that there is not any access to packet payload and second there is not any need for knowledge of port numbers [112].

4.2.3 Traffic Monitoring

Traffic Monitoring is responsible to detect the group of hosts that have similar behavior and communication pattern by inspecting network traffics. Therefore we are capturing network flows and record some special information on each flow. We are using Wireshark which is an open source tool [ ] for monitoring flows and record information that we need in this part. Each flow record has following information: Source IP(SIP) address, Destination IP(DIP) address, Source Port(SPORT), Destination Port(DPORT), Duration, Protocol, Number of packets(np) and Number of bytes(nb) transmitted.

Table 4.1: Recorded information of network flows using ARGUS

Then we insert this information on a data base like Table 4.1, which are network flows. After this stage we specify the period of time which is 6 hours and during each 6 hours, all n flows that have same Source IP, Destination IP, Destination port and same protocol (TCP or UDP) are marked and for each network flow (row) we calculate Average number of bytes per second and Average number of bytes per packet:

* Average number of bytes per second(nbps) = Number of bytes/ Duration

* Average number of bytes per packet(nbpp) = Number of Bytes/ Number of Packets

Then, we insert this two new values ( nbps and nbpp) including SIP and DIP of the flows that have been marked into another database, similar to Table 4.2 . Therefore, during the specified period of time (6 hours), we might have a set of database, which each of these databases have same SIP, DIP, DPORT and protocol (TCP/UDP). We are focusing just at TCP and UDP protocols in this part.

Table 4.2: Database for analogous flows

As we mentioned earlier, the bots inside the same botnet have same characteristics. They have similar behavior and communication pattern, especially when they want to update their commands from botmasters or aim to attack a target; their similar behaviors are more obvious. Therefore, next step is looking for group of Databases that are similar to each other.

We proposed a simple solution for finding similarities among group of databases. For each database we can draw a graph in x-y axis, which x-axis is the Average Number of Bytes per Packet (nbpp) and y-axis is Average Number of Byte per Second (nbps). (X, Y)= (bpp, bps)

For example, in database (), for each row we have nbpp that specify x-coordinate and have nbps that determine y-coordinate. Both x-coordinate and y-coordinate determine a point (x,y) on the x-y axis graph. We do this procedure for all rows (network flows) of each database. At the end for each database we have number of points in the graph that by connecting those points to each other we have a curvy graph. We have an example, figure 4.6, for two different databases based on our assumption that their graphs are almost similar to each other.

Next step is comparing different x-y axis graphs, and during that period of time (each 6 hours) those graphs that are similar to each other are clustered in same category. The results will be some x-y axis graphs that are similar to each other. Each of these graphs is referring to their corresponding databases in previous step. We have to take record of SIP addresses of those hosts and send the list to next step for analyzing.

4.2.4 Malicious Activity Detector

In this part we have to examine the network traffics that going out from the network and try to detect the potential malicious activities that the internal machines are performing. Scanning and spamming are the two malicious activities that usually and mainly botnets are doing in the network. However, botnets can perform many other malicious activities. Scanning

Botnets use Scanning for propagation of some malware like worm and virus and also as a platform for DOS attacks. As we can see in figure 4.7 in many areas around the world scanning is performing. There has been little work on the problem of detecting scan activities. Most scan detection has been based on detecting N events within a time interval of T seconds. This approach has the problem that once the window size is known, the attackers can easily evade detection by increasing their scanning interval. Snort are also use this approaches. Snort uses two preprocessors for this issue. The first is packet-oriented, concentrating on detecting abnormal packets used for “secrecy scanning” by tools such as nmap [18]. The second is connection oriented. Snort suffers from the same drawbacks as Network Security Monitor (NSM)[ 62] since both rely on the same metrics [102].

Other work that focused on scan detection is by Staniford et al. on Stealthy Probing and Intrusion Correlation Engine (SPICE) [1]. SPICE is focusing on detecting sneaky scans, especially scans that spread across several source IP addresses and execute at very low rates.

An important need in our system is quick response; however reaching to our target in detecting malicious scanners is a difficult task. Another solution is also using Threshold Random Walk (TRW) [102], an online detection algorithm which is based on sequential hypothesis testing.

After assessing different approaches for detecting scanning activities, the best solution for using in this part is Statistical sCan Anomaly Detection Engine (SCADE) [32]. In figure 4.8 we can see the architecture of SCADE in Bothunter framework.

Inbound Scan Detection (ISD): In this part SCADE has focused on detection of scan activities based on ports that are usually used by malware. One of the good advantages of this procedure is that it is less vulnerable to DOS attacks, mainly because its memory trackers do not sustain each external source IP addresses. SCADE here just tracks scans that are targeted to internal hosts. The bases of Inbound Scan Detection are on failed connection attempts. SCADE has two types of ports: High-Severity (hs) ports specified for highly vulnerable and commonly exploited services and low-severity (ls) ports. For make it more applicable in current situation SCADE focused on TCP and UDP ports as high-secure and all other as low-secure ports. There are different weights to a failed scan attempt for different types of ports.

The warning for ISD for a local host is produced based on an anomaly score that is calculated as based on this formula:

: indicate numbers of failed attempts at high-severity ports.

: shows numbers of failed attempts at low-severity ports.

Outbound Scan Detection (OSD): SCADE in this part has three anomaly detection module which work together and follow all outbound connection per internal host:

• Outbound scan rate (s1): Detects local hosts that perform high-rate scans for many external addresses.

• Outbound connection failure rate (s2): Detects unusually high connection fail rates, with sensitivity to HS port usage. The anomaly score s2 is calculated based on this formula

Fhs: indicate numbers of failed attempts at high-severity ports.

Fls: shows numbers of failed attempts at low-severity ports

: is the total number of scans from the host within a time window

• Normalized entropy of scan target distribution (s3): A consistently distributed scan target model provides an indication of a possible outbound scan. “It is used an anomaly scoring technique based on normalized entropy to identify such candidates” [32]:

H: is the entropy of scan target distribution which

m: is the total number of scan targets

: is the percentage of the scans at target Spam-related Activities

E-mail spam, is the practice of sending useless email messages, in large scale to an indiscriminate set of recipients. More than 95% of email on the internet is spam, which most of these spams are sent from botnets. As shown in figure 4.9, there are many malicious activities that related to email such as phishing email, spam email and spoofed email.

A common approach for detecting spam is the use of DNS Black/Black Hole List (DNSBL) such as http://www.dnsbl.info/dnsbl-list.php. DNSBLs specify a list of spam senders' IP addresses and SMTP servers are blocking the mail according to this list. This method is not efficient for bot-infected hosts, because legitimate IP addresses may be used for sending spam in our network.

Creation or misuse of SMTP mail relays for spam is one of the most well-known exploitation of botnets. As we know user-level client mail application use SMTP, as shown in figure 4.10 for sending messages to mail server for relaying. However for receiving messages, client application usually use Post Office Protocol (POP) or the Internet Message Access Protocol (IMAP) to access the mail box on a mail server. Our idea in this part is very simple and efficient. Our target here is not recognizing which email message is spam,

Reference Copied to Clipboard.
Reference Copied to Clipboard.
Reference Copied to Clipboard.
Reference Copied to Clipboard.
Reference Copied to Clipboard.
Reference Copied to Clipboard.
Reference Copied to Clipboard.

Request Removal

More from UK Essays

Get help with your dissertation
Find out more


Greek and the meronymy pdf

The term first appeared in the 1970s, though there were lexicologists in essence before the term was coined. Sometimes lexicography is considered to be a part or a branch of lexicology, but properly speaking, only greek and the meronymy pdf who actually write dictionaries are lexicographers. Some consider this a distinction of theory vs. Cognitive lexical semantics is thought to be most productive of the current approaches.

It studies compound meanings of two or more words, as in “raining cats and dogs”. Because the whole meaning of that phrase is much different from the meaning of words included alone, phraseology examines how and why such meanings come in everyday use, and what possibly are the laws governing these word combinations. Since lexicology studies the meaning of words and their semantic relations, it often explores the origin and history of a word, i. Etymology can be helpful in clarifying some questionable meanings, spellings, etc. For example, etymological dictionaries provide words with their historical origins, change and development. As there are many different types of dictionaries, there are many different types of lexicographers. Questions that lexicographers are concerned with are for example the difficulties in defining what simple words such as ‘the’ mean, and how compound or complex words, or words with many meanings can be clearly explained.

Also which words to keep in and which not to include in a dictionary. Dirk Geeraerts, The theoretical and descriptive development of lexical semantics, Prestructuralist semantics, Published in: The Lexicon in Focus. Competition and Convergence in Current Lexicology, ed. Leila Behrens and Dietmar Zaefferer, p. Dirk Geeraerts, The theoretical and descriptive development of lexical semantics, Structuralist and neostructuralist semantics, Published in: The Lexicon in Focus. Ein Internationales Handbuch Zur Natur and Struktur Von Wortern Und Wortschatzen, Vol 1.

This page was last edited on 22 December 2017, at 08:14. Metonymy and related figures of speech are common in everyday speech and writing. Greek and Latin scholars of rhetoric made significant contributions to the study of metonymy. Unsourced material may be challenged and removed. Sometimes an absolute distinction is made between a metonymy and a synecdoche, treating metonymy as different from, rather than inclusive of, synecdoche. When the distinction is made, it is the following: when “A” is used to refer to “B”, it is a synecdoche if A is a component of B or if B is a component of A, and a metonym if A is commonly associated with B but not part of its whole or a whole of its part.


Leg Muscle Cramp Remedies

Order Recovery e21Leg cramps are involuntary muscles that contract and are unable to relax.  They can be very painful, and often feel like the muscle is hard and swollen as the muscle hardens.  While cramps can occur anywhere in the body, they are most commonly experienced in the lower leg, calf or front and back of thigh.

What causes leg cramps?

Muscle cramps most often occur when the muscle is fatigued either from overuse or injury.  Dehydration and electrolyte imbalance is  another cause of muscle cramps and are experienced often while swimming, playing tennis or other active sports.

How can I prevent or help reduce the occurrence of leg muscle cramps?

If leg cramps occur during exercise, stop immediately.  Stretch the muscle and do a light massage to help the muscle get back to the original shape.  Heat will also help relax the muscle, then try massaging it again.  Once the muscle has relaxed, you may use ice to help relieve any pain caused by the cramp.  If the pain persists consider an over the counter pain medication or NSAID.

Always keep yourself well hydrated before, during and after all sports activities.  If you are experiencing great amounts of sweat loss, then make sure to replenish electrolytes as well (sports drink, salt or electrolyte supplement). Always perform adequate stretching before and after all sports and or exercise routines.

Foods that may help with Leg Cramps?

To help prevent leg cramps, start by staying well hydrated and using sports drinks or electrolyte supplements, especially when working out in the summer or warm conditions.  Also, consuming foods rich in vitamin D like fish (salmon, halibut), milk, oatmeal will help to avoid muscle cramps.

As always, if leg cramps persist or are extremely painful, consult your physician for further treatment.


Thursday, February 20, 2014

Master Closet: Part 1 I've decided to update/optimize the walk-in closet in the master bedroom.  First thing I needed to do was assess the situation.  Taking measurements should always be your first step.  It's hard to plan anything, if you don't know exactly how much space you have.

Our closet is 75" wide, by 52" deep with double closet rods on the right side, and a single pole on the left.  There is a short shelf that runs above each set of closet poles, close to the ceiling.  The closet also has an inward opening 24" entry door (exactly like all of the bedroom/bathroom doors in the house).  Most closets will have a bi-fold door, or an outward opening door.  This keeps the door from interfering with the available space inside the closet.  Unfortunately, one of the problems with our closet, is that you had to walk inside, then close the door behind you in order to access anything on the right hand side of the closet.  This meant I would have to find another solution for the door.

I've never been a huge fan of bi-fold doors.  They tend to sag over time, and if your opening isn't perfect, they just never look right to begin with.  Some might say they look cheap.  But....when you're trying to utilize every bit of space you can in a closet, the bi-fold is a pretty simple solution.  Since our door was only 24" wide, replacing it with a 24" bi-fold would mean that when the door was opened, the folded door would take up about two inches of space inside the door frame and stick straight out.  With limited space in the bedroom, this means entry to the closet could be awkward.  What I decided to do instead, was buy a 24" bi-fold door, and remove the hinges in the center.  I would then carve out hinge pockets into the outsides of the two halves so I could hang them on the existing door frame (but opening outward instead of inward).  This will allow me to open two tiny 12" doors which will swing fully open, taking up very little space on the wall, and allow full use of the 24" opening........but we'll get back to the door project later.  We have cabinets to design and build.

First thing I did was use a ruler and pencil to sketch up a quick overhead layout of the closet, being careful to scale down my measurements as accurately as possible.  My drawing took up most of an 8.5x11" piece of printer paper.  I then just sorta drew in some boxes where I thought the cabinets might fit. I figured out how wide I thought the cabinets could be, and decided this plan was going to work.....what I decided to do was place two cabinets against the front wall of the closet so when you walked into the door, you'd have the open fronts of both cabinets facing your right and left sides.  Then I wanted to put another cabinet on the back wall facing you as you walked in.  Since I had about 25.5" between the closet door opening and each side wall, I figured I should make the cabinets 24" deep to utilize as much space as possible.  Since I've only got 52" of closet depth, I needed to make the cabinets as narrow as possible (while still being functional) so I could maximize the amount of closet rod length between the cabinets and the back wall.  16" seemed like it would be a good fit.

Our closet rods (like many houses) were spaced about 12" from the wall, so assuming I left an equal 12" on both sides of the rod (that's 24" total from the wall for those of you playing along at home), I should have about 27" of usable space between the two sides at the back wall.  I wanted to build a cabinet on the back wall that was 25" wide by 16" deep.  I planned on making all cabinets 84" tall from floor to ceiling.  I wanted to keep the right side of the closet as a double rod setup.  On the left side, instead of the single rod, I wanted to use half of the space with a double rod setup, but leave the other half as a single rod so there would still be some space for hanging long items.  I figured a divider wall that ran between the closet rods could make this work just fine.

While at work the next day, I bounced my ideas off a friend of mine who used to run a finish carpentry side business.  He's done a decent amount of cabinet work in the past, and has a good imagination when it comes to stuff like this.  While he liked my ideas, he pointed out that even though I would be using up what might be considered wasted space with my full depth cabinets, it would make the closet seem very cramped.  So after deciding he was right, I wanted to see what all of this would look like in 3D.  I did some searching on the internet and found a program called Sketchup which allows you to make really nice 3D designs, much like expensive CAD programs, but this has more limited features, and the trial version is free to use for non-commercial purposes.  I downloaded the program and watched a ton of tutorial videos on YouTube.  Eventually I started to get the hang of it, and this is what I came up with:

This program is really awesome!  I know you're probably thinking, "But Gib.....I can't do that!".....sure you can.  I did this after just a few hours of playing with the program, and I had no prior experience.  The cool thing about this program, is I can grab and spin the entire drawing around so I can see it from any angle.

So, in this drawing, the side cabinets have been reduced to 20" depth, and the back cabinet is now 22" wide by 12" deep.  This allowed me to open up the space inside the closet a bit without really losing any usable shelving space.  You might also notice that the cabinets are now do not touch the floor.  My friend Shannon suggested allows me to use the small space under the cabinet on the floor for any abnormally long items, and it's just aesthetically pleasing.  You can see the short divider wall on the back side of the closet which separates the double rod from the single rod.  The cabinets are now 72" tall instead of 84", and all of the shelving in the front side cabinets is adjustable using shelf pin holes (much like you see on the cheap particle board closet kits you can buy at the big box stores).  The back cabinet has a fixed shelf in the middle with adjustable shelving above and drawers below.  Full width shelves will go around the top of all three cabinets.  You'll also notice that the cabinets have a nice face frame on the front.  Not only does it look better that way, but the frames will give added support to the plywood boxes.

One of the cool things about this setup, is that we're adding in a bunch of stuff that takes up space inside the closet, but believe it or not, we're actually going to gain usable space.  Right now, Melissa's jeans are folded into a stack that sits on a milk crate on the floor.  The rest of the floor is lined with shoes and boots.  We currently have a total of 156" of closet rod....but much of that is used for clothing that would be better suited for folding up on the shelf.  Once the cabinets are in, we'll lose 30" of closet rod.....BUT we'll also be gaining almost 33 square feet of shelf space and 4 cubic feet of drawer space!!  Needless to say.....I'm pretty excited about it.

Next update.......we get down to business and make some sawdust fly.

  1. If the space is available pocket doors are great

  2. While I agree that a pocket door would probably be the best solution for our closet (as well as the bathroom), I didn't feel like tearing down any of the walls to install one. The re-worked bi-fold door should do I sit and wonder why the guy who rebuilt this house didn't install pocket doors to begin with....


Evidence of evolution essay
Rated 5/5 based on 30 review

Evidence of evolution essay

Darwin and natural selection most educated people in europe and the americas during the 19th century had their first full exposure to the concept of evolution. How to defend evolutionism against creationism the theory of evolution has been around since the 1800s and is widely accepted around the world evolution by natural. Evolutionists may never be persuaded by evidence alone, evidence against evolution a national geographic photo-essay showing the diversity of ocean-dwelling. Human evolution is the lengthy process of change by which people originated from apelike ancestors scientific evidence shows that the physical and behavioral traits. Free essay: there are many reasons why people should believe in darwin’s theory of evolution one of the more compelling reasons is the anatomical.

Duane gish, noted creationist, lays out a case against evolution, drawing on evidence from the fossil record, homology, vestigial organs, molecular biology. There is so much evidence in favor of evolution that arguing against it is like denying that there is 8 examples of evolution in action lordzb november 19, 2011. Dna evidence for evolution - what aspects of genetics do darwinists interpret as dna evidence for evolution and how do opponents of the theory respond. This essay will focus on: the early evolution of our eukaryote there exists a myriad of sources and an evaluation of the evidence suggests that evolution,.

Evolution home: similarities among living organisms one type of evidence for evolution (evidence that organisms are related, descended from a. Evidence of evolution the nobel prize winning scientist linus pauling aptly described science as the search for truth science does this by continuously. 1 homologous organs provide evidence for evolution: if we look at the way in which living organisms are made, we can often see quite striking similarities in their.

15 answers to creationist nonsense opponents of evolution want to make a place for creationism by tearing down real science, but their arguments don't hold up. In evolutionary debates one is apt to hear evolution roughly parceled between in this essay, none of the evidence assumes that natural selection is sufficient. When we think of human evolution, 5 signs humans are still evolving by jessica hullinger october 26, 2015 getty images/hulton archive. Evidence for evolution evolution is defined as the change in genetic material of a population of organisms from one generation to the next all living. Read evidence of evolution free essay and over 88,000 other research documents evidence of evolution basilosaurids and dorudontids lived in the late eocene.

An article by john oakes, phd describing four christian views of evolution, along with strengths and weaknesses of the four views this essay is intended as a guide. Evidence for evolution, free study guides and book notes including comprehensive chapter analysis, complete summary analysis, author biography information, character. Scientific evidence for evolution comes from many aspects of biology and includes fossils, homologous structures, the tangled bank: an introduction to evolution.

2 outline •evidence for evolution from microbiology •basics of genetics •ubiquitous proteins and dna sequences •evolution in the lab •speciation in nature. Evolution relies on evidence from fossil records, similarities between life forms, the geographic distribution of species, and recorded changes in species. Remains of what is the evidence for evolution essay homo neanderthalensis have been found what is the evidence for evolution essay at sites throughout europe, as well.

  • The idea of evolution this essay considers three kinds of evolution that have had some australopithecus forms provide the earliest clear evidence of upright.
  • The topic of creation vs evolution is a very controversial one, and therefore extremely popular for the persuasive essay writer.
  • Evidence of evolution essays: over 180,000 evidence of evolution essays, evidence of evolution term papers, evidence of evolution.

Fossil record essay, a rare fossil record the preservation of embryos and juveniles is a rate occurrence in the fossil record theres another cavernous gap in the. Since darwin first proposed his ideas about biological evolution and natural selection, different lines of research from many different branches of science have. List and define darwin’s four postulates of evolution essay of living species and the fossil record provide evidence for evolution evolution test.

evidence of evolution essay Click on the item you would like to review: lecture notes exercises : lecture notes darwin's evidence for evolution: embryology i the facts of embryology. evidence of evolution essay Click on the item you would like to review: lecture notes exercises : lecture notes darwin's evidence for evolution: embryology i the facts of embryology. Download

2018. Term Papers.


With Hurricane season ending officially November 20th, and another harsh season of winter storms beginning – our trees can never have a break! Hurricanes this past year have knocked down thousands of trees across the U.S. These major tropical storms were able to weaken trees to the point of falling. Trees would knock out power lines, or even worse, block major roads and even leave people stranded.

With the winter season coming, the same thing is bound to happen. High winds will weaken the tree’s structure and heavy snow will be too much for branches to sustain. Many tree branches fall during the winter, causing damage to houses, yards, etc. If the snow is heavy enough, trees can loosen and fall.

Not only does heavy snow affect the trees, but the cold temperatures cause trees to rot and die. Frost cracks also happen to trees when the temperature is below 15 degrees. The wood contracts faster than the inside layer with a drop in temperatures. This gives the tree big vertical cracks at the weak areas of the tree trunk. Almost all trees can end up with vertical cracks. If you see a lot of cracks in your tree, your tree may be dying. You can contact Precision Cutting Services for a free tree removal estimate.

Aside from the cold weather affecting trees, the lack of water causes the majority of the Northern deciduous trees to fall. Trees with needles are more capable of sustaining winter weather with regards to water loss. Trees with needles have less of a surface area than leaves, which allows for more water-loss control. But, this type of tree with needles such as the conifer, still lose a lot of dead needles off the tree which can cause them to die.


The operation

This is what happens during the operation itself.

  • a cut is made behind the ear

 After The Operation

Nucleus BTE speech processor,microphone and coil with image of internal partA cochlear implant is a sophisticated hearing aid which requires an operation. There are risks are associated with this as follows.

Infection is possible but antibiotics are given to reduce this.
Bleeding can occassionally occur with formation of a haematoma (blood clot) under the skin – during the operation every attempt is made to reduce this risk
Facial Palsy, which causes a weakness of one side of the face, rarely happens as the nerve function is monitored during surgery
Balance disturbance and tinnitus are problems that some patients already have – any balance problems or tinnitus related to surgery should soon settle
Device failure is uncommon, but if it occurs may require re-implantation of a new implant.

To-date we have not experienced any major complications during surgery or in the early post-operative phase.

 After Care

Can a cochlear implant really change your life? 60 adults receiving cochlear implants were asked to complete a questionnaire once before their implant and then one year afterwards to examine the impact on their lives. The results are interesting.

Chris PatientConfidence, relaxation and independence all show improvement from pre-implant to one year or more post- implant. Negative factors associated with deafness such as isolation and embarrassment show improvement in that these decrease post-implant.

In terms of speech perception as measured by nationally recognised test materials used pre- and post- implant, results show that speech perception with lip-reading improves greatly post-implant for most adults. Some adults are able to understand speech without the need for lip-reading.

Use of Cochlear Implant 94.5% of those responding to the questionnaire used their cochlear implant for eight or more hours a day and 5.5% use their cochlear implant for four to eight hours a day. None of the respondents use their cochlear implant for less than four hours a day.

Limitations to Use There are limitations on certain activities that could damage or move the implant eg rugby, boxing and squash. However, swimming is possible if external parts are removed.
There are other precautions to be aware of and users can find more information on the BCIG website at

Implants and Tinnitus A The degree of relief from tinnitus will depend on individual circumstances. However, many implant users find that the implant and the sounds it produces substantially mask the tinnitus, but this will depend on individual circumstances.


Location of Repository

Mutations in the Arabidopsis Peroxisomal ABC Transporter COMATOSE Allow Differentiation between Multiple Functions In Planta: Insights from an Allelic Series\ud \ud

By D. Dietrich, H. Schmuths, C.D. Lousa, J.M. Baldwin, S.A. Baldwin, A. Baker, F.A. Theodoulou and M.J. Holdsworth

COMATOSE (CTS), the Arabidopsis homologue of human Adrenoleukodystrophy protein (ALDP), is required for import of substrates for peroxisomal β-oxidation. A new allelic series and a homology model based on the bacterial ABC transporter, Sav1866, provide novel insights into structure-function relations of ABC subfamily D proteins. In contrast to ALDP, where the majority of mutations result in protein absence from the peroxisomal membrane, all CTS mutants produced stable protein. Mutation of conserved residues in the Walker A and B motifs in CTS nucleotide-binding domain (NBD) 1 resulted in a null phenotype but had little effect in NBD2, indicating that the NBDs are functionally distinct in vivo. Two alleles containing mutations in NBD1 outside the Walker motifs (E617K and C631Y) exhibited resistance to auxin precursors 2,4-dichlorophenoxybutyric acid (2,4-DB) and indole butyric acid (IBA) but were wild type in all other tests. The homology model predicted that the transmission interfaces are domain-swapped in CTS, and the differential effects of mutations in the conserved "EAA motif" of coupling helix 2 supported this prediction, consistent with distinct roles for each NBD. Our findings demonstrate that CTS functions can be separated by mutagenesis and the structural model provides a framework for interpretation of phenotypic data. \u

Publisher: The American Society for Cell Biology
Year: 2009
OAI identifier: oai:eprints.whiterose.ac.uk:5429

Suggested articles


There are so many ways in which our children’s behaviour can challenge us. Examples include defiant behaviour, tantrums and meltdowns, and there can even be complex combinations of a variety of problems throughout the one day. At Spring Forward, we use a variety of research-based techniques to help parents learn to better understand and manage their children’s behaviour in a loving, safe way, that helps to build the relationships between parents and their children. Please let us help restore some peace in your family!

Compulsive Behaviour

While all kids experience times of worry and doubt, some children with compulsive behavioural tendencies just can’t stop worrying, and those worries frequently compel them to behave in certain ways over and over again. Compulsive behaviour is typically a product of anxiety, where a person is often preoccupied with dangerous, harmful or dirty thoughts – when working with kids, we call these ‘sticky’ thoughts, to help them understand the tendency of the thought to stick like glue.

Children may have a difficult time explaining a reason for their compulsions, but in general, anybody with a compulsive disorder is using rituals to relieve anxiety. At Spring Forward, we use child-friendly words and game-like techniques to help children understand the reasons behind their compulsions and to help relieve their underlying anxiety with research-based programs.

Compulsive behaviour is a very treatable condition, and depending on the severity, a combination of medical and therapeutic treatments may be implemented that can help unlock your child from their mental prison.

sad boy
Defiant Behaviour
boy looking through chain link fence

Have you ever heard of the “Terrible Twos”? Or are you at your wits end living with a “Threenager”? At some time or another, it is inevitable that children will try to exercise their decision-making abilities and push their boundaries to see exactly where they fit into a family and social structure. However, some children are unable to simply “grow” out of this behaviour and will become defiant in an ongoing capacity. This behaviour may be symptomatic of underlying medical issues such as depression or anxiety disorders, and the behaviour itself often negatively affects a child’s ability to learn and make friends. With the right strategies and skills set into motion by a good therapist, defiant behaviour can be decreased, improving the overall wellbeing of the sufferer and their family. At Spring Forward, we have family members with ‘ODD’ (Oppositional Defiant Disorder), so we understand what you’re going through and are only too keen to help. Nothing pleases us more than watching a parent implement the techniques we’ve taught them and their child respond appropriately!

Tantrums and Meltdowns

Parents and carers expect temper tantrums from 2- and 3-year-olds, but did you know that there’s a difference between tantrums and meltdowns? As children get older, tantrums become more about being a power struggle, whereas a meltdown is the result of too much information – being pushed by the world around us to the point of snapping. Kids of all ages can experience difficulty handling anger and frustration, but meltdowns are different and can be caused by things such as too much time in a noisy environment.

In summary, some children have more challenges with their behaviour than others, but our team has seen it all before and is ready to help your family. We will teach you the strategies to put in place and will support you every step of the way. Although these skills take time to develop, every child can benefit from our range of interventions.

Sad girl

Depending on whether our own children are having a meltdown or not, and have remembered to take their ADHD medications, we will respond shortly. 😉


A patient presents with jaw pain.  At triage, 100.4 is found to be her temperature.  She is a poor historian. You ask specific, targeted questions in an effort to narrow the differential diagnosis.  She answers each by redoubling her description of the pain. Routine examination is unrevealing.  The dentition appears normal.  She has difficulty localizing the pain. You palpate for pre and postauricular lymph nodes and note she has scalp tenderness.  Could this be temporal arteritis?

Temporal arteritis is actually a misnomer, as it tends to affect any of the cranial vessels from the aortic arch.  The pathologic diagnosis, and the modern preferred term, is “giant cell arteritis.” It is strongly associated with polymyalgia rheumatica, a periarticular synovitis presenting with pain and morning stiffness of the shoulder girdle, but can also affect the neck and pelvic girdle.(Salvarani NEJM 2002)

Giant cell arteritis presents with four categories of symptoms:

1) Cranial arteritis – stroke, amaurosis fugax, diplopia, etc.

2) Extracranial arteritis – headache and scalp tenderness, jaw claudication, etc.

3) Systemic symptoms – fatigue, anorexia, fever, malaise, weight loss, fever etc.

4) Polymalgia rheumatica – synovitis of the periarticular structures of the shoulder and other musculoskeletal units, especially hand edema.

Temporal arteritis is a pathologic diagnosis, and this pathology is actually something that can be directly examined. The temporal artery emerges preauricularly and forks into the frontal branch and parietal branch. Palpate in these areas.  Does it feel inflamed? Is there tenderness?  Dilation?  Absence of a pulse?  Any of these abnormalities might indicate temporal arteritis.

The 1990 American College of Rheumatology criteria for diagnosis starts with age,  headache, and any temporal artery abnormality on physical examination.(Hunter Arthritis Rheum 1990)

The original description by Hutchison in 1890 tells you what you might see: red linear streaks on the head, painful, swollen temporal arteries, which eventually become firm and pulseless.

Take home points:

-The temporal artery is accessible to palpation

-Temporal arteritis can be recognized at the bedside by inspection and palpation of the temporal artery

A patient presents to the emergency department in labor.  You check and as you look, she pushes the head out which you catch just in time with some counter-pressure to control delivery. But now things stop and the shoulder won’t deliver. You run your finger between the neck and shoulder – no nuchal cord. What do you do next?

The goal is to get the baby out as soon as possible and prevent hypoxic ischemic encephalopathy and brachial plexopathy (Gurewitsch Clin Ob Gyn 2007). You have about 6-8 minutes of “head-to-body” time until brain injury can occur (time the head is sitting on the perineum). Try a maneuver for shoulder dystocia, but if it does not lead to easy delivery then it did not work and quickly go to the next one.  This is the right kind of haste.  The wrong kind of haste is to jerk the child out, which risks brachial plexopathy.  Finesse is needed, not force.

Most of the risk of brachial plexopathy is from lateral traction on the neck.  Axial traction is much safer.  If one finds that lateral traction would be needed, it usually means positioning of the fetus is not yet ideal.

In recent years, suprapubic pressure (intended to push the obstructed shoulder posteriorly) and McRoberts maneuver (hyperflexion of the hips) are emphasized.  These maternal maneuvers do work 25-40% of the time. Additionally, McRoberts can help open up passage of the fetus deeper into the pelvis and improve the transit. However, a few generations ago in the 1940s fetal manipulation was used predominantly, and rates of brachial plexopathy were actually lower. (Gurewitsch 2007)

Rotational manipulation of the fetus is safe and effective, and should be turned to quickly in cases of dystocia, long before lateral traction is considered.

You try suprapubic pressure and the child’s shoulder moves slightly.  You then rotate the infant and the delivery follows spontaneously.

Take home points:

-For shoulder dystocia, fetal manipulation can be more effective than maternal manipulation

-if one maneuver does not fully solve the problem, go to the next maneuver

-Lateral traction of the neck is to be avoided

Take home points:

-Use the Epley maneuver in BPPV without nystagmus

You are taking care of a patient with sepsis of unclear cause and find hypoxemia.  The chest x-ray is normal.  What is causing the hypoxemia?

When the history and physical examination do not reveal an explanation for hypoxemia, it helps to think physiologically. Air, chest vasculature, and blood all are essential.

Classically, hypoxemia is caused by:

Low PiO2 (example, altitude)

Lungs: Impaired diffusion (now thought to be an uncommon contribution)

Alveolar hypoventilation

V/Q mismatch (diseases of the chest)

Shunt (a type of V/Q mismatch with theoretically zero ventilation)

Dead space (a type of V/Q mismatch with theoretically zero perfusion)

At the bedside, the relevant differentiation is alveolar hypoventilation from V/Q mismatch.  Is the patient alert and breathing adequately? Order an arterial blood gas if there is doubt, and look for elevated CO2 as an indicator of underventilation.  For everything else, consider the lungs and the heart.

In this case, further questioning of the patient revealed longstanding tobacco use and subsequent chronic obstructive pulmonary disease.  The patient has chronic V/Q mismatch.

Take home points:

For unexplained hypoxemia, assess ventilation

If ventilation is normal, pursue diseases of the chest

Take home points:

Using physical diagnosis to decide strangulation is usually not possible

Using physical diagnosis to decide incarceration is easy

Patients with incarcerated hernias need surgical evaluation

A patient is found to have unexpected tachycardia.  What is the cause?  We use associated symptoms and signs to guide the diagnostic approach.  When that isn’t clear, a physiologic approach might enhance bedside diagnostic reasoning:

Although the simple equation in a living organism belies much deeper complexity, we can reason that an increase in heart rate means one of three things:

1. Stroke volume is decreased

a. Decreased preload (hypovolemia, pulmonary embolism)

b. Decreased inotropy (congestive heart failure)

c. Increased afterload (hypertensive congestive heart failure)

2. Cardiac output is increased

3. Primary disturbance in heart rate

Using this approach generates its own differential diagnosis, and may help in subtle presentations.

Take home points:

-CO = SV x HR

-An increased heart rate suggests increased cardiac output or decreased stroke volume


#IranOpenAlbum Rules

#IranOpenAlbum is an administered Flickr photo database intended to provide international journalists and editors in the licensed access to a wider range of images of Iran. We hope Iranian and international professional and amateur photographers will contribute a few photos to this open album. Access to the database will be made available to journalists and editors at reputable international news agencies (as well as the general public) so that images can be downloaded and used to accompany written pieces and other reports under a Creative Commons Attribution 4.0 International license. We believe photographers should be compensated for their work, but #IranOpenAlbum is an interim solution while Iran remains underserved by photo agencies. We hope this collaborative effort will allow journalists and editors to represent Iran more accurately and dynamically as part of their reporting.

Submission Rules:

  1. Submissions must be made by email to iranopenalbum@bourseandbazaar.com
  2. Only the owner of the photo may submit it to the administrator
  3. Photos must be high quality, high-resolution.
  4. Desired photos include, but are not limited to, images that show Iranian people of significance, places of significance, events (such political rallies or sporting events), images of industry and the economy, images of daily life, and landscapes and wildlife images
  5. By uploading the photo, the owner consents to its use in accordance with the Creative Commons Attribution 4.0 International license (CC BY 4.0). This allows anyone to:
    • The terms of the license require attribution: The user must give appropriate credit, provide a link to the license, and indicate if changes were made. The user may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use. The full terms of the license can be read here: https://creativecommons.org/licenses/by/4.0/legalcode
  6. The administrator reserves the right to decline to upload or remove any photos, which are too low quality for editorial use, or of a subject matter of little journalistic value.
  7. The administrator reserves the right to decline to upload or remove any photos, which are deemed inappropriate due to the graphic nature or political message.
  8. When submitting a photo, please include the following information in English in the body of the email to make the image searchable:
    1. Photographer’s Name
    2. Subject of Photo (in a few words)
    3. Location of Photo
    4. Date Taken

If you have any questions, please contact the administrator at iranopenalbum@bourseandbazaar.com.