Botconf is an international technical and scientific conference aiming at bringing together academic, industrial, law enforcement and independent researchers working on issues related to the fight against botnets and malware ecosystems.

The first day (Tuesday) is dedicated to delivering workshops in front of a smaller audience. The next three days are the main conference with 25 presentation slots ranging from 20 to 50 minutes, and a lightning talk session (3 minute talks proposed on site by the participants).

NEW: The Sprint CFP (to be opened in March 2027) is dedicated to late-breaking contributions: freshly completed research, new discoveries, and just-released findings that missed the main CFP deadline. There are two slots in the programme for the Sprint CFP selection.

Speakers for the Sprint CFP are invited in the same conditions as other speakers. They need to be ready to organise their travel quickly if they are not already registered to attend.

Some presentations are accompanied by the publication of a scientific paper with our partner open journal, "The journal on cybercrime & digital investigations(opens in new tab)", edited by the CECyF(opens in new tab), the French cybercrime centre of excellence.

=== Diversity ===

Botconf is an international conference and welcomes specialists from all around the World, but is also supporting diversity in all forms : origin, gender, sexuality, handicap.

So please all feel welcome to submit if you believe you can bring a contribution to the community !

If you attend Botconf don't hesitate to tell us about any special needs you might have, we will thrive to do our best to accomodate.

=== Topics of interest ===

Originally, Botconf was focused on botnets. We have decided in 2022 to expand it to all malware ecosystems.

* Botnets: “The term botnets is used to define networks of infected end-hosts, called bots, that are under the control of a human operator commonly known as the botmaster. While botnets recruit vulnerable machines using methods also utilized by other classes of malware (e.g., remotely exploiting software vulnerabilities, social engineering, etc.), their defining characteristic is the use of command and control (C&C) channels to connect bots to their botmasters.”
(A multifaceted approach to understanding the botnet phenomenon, Moheeb Abu Rajab, Jay Zarfoss, Fabian Monrose, Andreas Terzis, in Proceedings of the 6th ACM SIGCOMM conference on Internet measurement (IMC ’06))

The proposed concept of malware ecosystems is the following:

* A malware ecosystem describes all the components that allow a cybercriminal activity using malware to succeed, including the various technical tools (malware code and binaries, obfuscation techniques, distribution platforms, exploits, etc.), the communication platforms and of course the actors involved (developers, brokers, money-launderers, etc.).

In this context, the following topics are expected:

* The functioning of botnets, and malware ecosystems.
* In particular, the functioning of malware, of distribution mechanisms and command & control infrastructure related to botnets.
* The understanding of the organisation of human groups involved in the development or the management of botnets or other types of malware ecosystems.
* Methods to monitor, localize and identify botnets and other organised distribution of malware.
* In particular, methods to detect, mitigate and disrupt botnet or malware ecosystem activities inside ISP networks or organisations’ networks.
* Technical, legal and other methods used to mitigate, investigate, dismantle or disrupt botnets and other malware ecosystems.
* The economics of cybercrime activities behind botnets and malware ecosystems.
* And we are also very much interested in having more non-technical presentations on law, criminology, analyses of behaviour of suspects related to those activities.

=== Types of submissions ===

Authors are invited to submit in one of the following groups:

* Workshops: the aim is to organise hands-on workshops on the day before the main conference to smaller groups of attendees on technical topics such as malware analysis, network trace analysis or command and control server discovery, etc.

OR, for the conference:

* Full paper: the intention of the author is to produce a full scientific paper, present his/her work at the conference (timeslots of 40 to 60 minutes will be allocated);
* Regular presentation: the intention of the author is to present at the conference (timeslots of 30 to 50 minutes will be allocated);
* Short talk: short talks are aimed at offering a platform for young scientists or young projects to present their work. The expected outcome is a 20 minutes presentation at the conference, but a short paper can also be prepared.