Shanghai University of Finance and Economics Essay Example for Free

Shanghai University of Finance and Economics Essay 1. Introduction Britvic Soft Drinks has a long and rich history. At first this company was then little more than a home business run from a chemists shop. Soon the company was producing all kinds of originally concocted soft drinks. It was only in 1949 that the Britvic brand was formally launched into the marketplace. Following the Second World War, Britvic went from strength to strength. In 1971, the British Vitamin Product Company formally changed its name to Britvic. Now, Britvic has two branded soft drink business which  supplies wide range of products. But Britvic has taken a hit, they improve position. Through marketing campaigns and drench brains campaign, including TV adverts and establish. It gives brand a great support and fit with the personality of the brand. Britvic increases market share and grow consumer awareness of its brands. Via fast moving and use different campaigns in various market. But Britvic also have some negative, for example the main consumer groups are young people. The old man Pay more attention to health. So Britvic need in keep original strength, for more consumer groups make action. Britvic places strong emphasis on brands and creating brand loyalty. They plan to launch a Tango, designed to attract older consumers. To expand consumption groups and have more benefits. 2.0 Key characteristics of the marketing concept 2.1 Marketing â€Å"Marketing is the process of communicating the value of a product or service to customers. Marketing might sometimes be interpreted as the art of selling products, but selling is only a small fraction of marketing. As the term Marketing may replace Advertising it is the overall strategy and function of promoting a product or service to the customer. † (Source: http://en.wikipedia.org/wiki/Marketing) Other marketing definitions are mentioned in the book and PPT is: â€Å"Selling goods that do not come back to customers who do at a profit which satisfied shareholders using means which satisfy other stakeholders.† (Source: SQA, 2006) â€Å"Marketing is process by which individuals and groups obtain what they need and want through creating and exchanging products and value with others.†(PPT) From those three definitions I think marketing is an activity. Marketing activities and strategies result in making products available that satisfy customers while making profits for the companies that offer those products. Marketing is delivered to the client satisfaction profit through the conversion. 2.2 Three key characteristics of the market concept The company should identify and define customer needs and wants as well as their expectations. All goods and services produced by the firm must satisfy the customer needs. Then they will keep returning as a frequent caller and purchase more goods. All departments, functions and sections of the business  must work together to meet the main objectives of the organization. You should let your employee satisfaction of their salary, and provide good working conditions, so that they will continue to work hard. Must follow government’s laws and pay taxes to create honesty. Marketing concept assumes that profit can only be achieved when customers are satisfied. The customers are entitled to a reasonable product for a reasonable price, while the firm is also entitled to a reasonable profit for a reasonable product. And company must be enough profit made to keep the business in operation. To ensure these characters, a successful company can be formed. 3.0 Britvic’s micro and macro environment A collection of companies that carry out similar tasks or provide similar benefits is called an industry. These organizations exist within an environment, which exerts an influence on the operations of the industry and the individual organizations within it. 3.1 Micro and Macro environment â€Å"The micro environment refers to the forces that are close to the company and affect its ability to serve its customers. It includes the company itself, its suppliers, marketing intermediaries, customer markets, competitors, and publics.† â€Å"The macro environment refers to all forces that are part of the larger society and affect the microenvironment. It includes concepts such as demography, economy, natural forces, technology, politics, and culture.† 3.2 PEST Analysis The PEST include political, economic, sociocultural, technological. Political factors are government meddling in the economy. If policy having changes, the market must make the corresponding change. Economic factors include economic growth, interest rates, exchange rates and the inflation rate. Economic factors can influence the enterprise operation. For example, exchange rates can influence of import and export goods. Social factors include the cultural aspects and include health consciousness, population growth rate, age distribution, career attitudes and emphasis on safety. This  factor can tell enterprise how to operate. To find a most conforms to the social needs of the operation. Technological factors include technological aspects such as RD activity, automation, technology incentives and the rate of technological change. The technological factors can change cost of production, how a business will run. 3.3 These environment relate with Britvic There have new rules on television advertising of food and drink to children aged fewer than 16 has led to the use of non-television campaigns. So young consumers become reduces, Britvic’s advertising strategy failures. In 2008, soft drinks sales decline due to the economic downturn. At that time consumers seek value for money. So soft drink was proved to be elastic demand. It cannot avoid the pressures of the economic crisis. Britvic can sell cold drinks in summer and in winter sell hot drinks. It is a new opportunity to make the drink market development. Package technology is a significant development in Britvic. Use bottled instead of glass bottle, it can make transportation more convenient. And nowadays the packages of soft drink are more and more advanced. At the same time it can meet customer demand and reduce the cost. 4.0 Important of market research and important gathered 4.1 What is marketing research? â€Å"Market research consists of testing the market to determine the acceptance of a particular product or service, especially amongst different demographics. It is used to establish which portion of the population will or does purchase a product, based on age, gender, location, income level and many other variables. Market research allows companies to learn more about past, current and potential customers, including their specific likes and dislikes.† 4.2 The importance of information Companies need information about their customer needs, marketing environment and competition. Companies can follow their information to sure how their business will run. Marketing managers do not need more information, they need better information. 4.3 Types of market research The types of market research is defining the problem and research objectives; developing the research plan for collecting information; implementing the research plan collecting and analyzing the data; interpreting and reporting the finding. Market research includes exploratory research, descriptive research and causal/predictive research. There are two main sources of marketing research data: Secondary research and Primary research. Secondary, or ‘desk’ research uses existing information, collected originally for some other purpose and now being used a second time. â€Å"When research is conducted to unearth original data, it is called primary research. To do this, an original research plan must be devised which will encompass, data collection, data input and then the production and analysis of the subsequent results. Due to the sometimes lengthy duration of this research it can often be expensive to conduct. However, because the research is original, the results gather ed will be more relevant to the needs of the client.† 4.4 Type of information The gathering information includes Secondary information and Primary information. â€Å"Primary information is information that has been obtained first hand, or is original. Primary information is the exact opposite of secondary information. Primary; original, first hand, principle, first priority information; knowledge there are many forms of primary information, these include; surveys (that you have conducted), interviews, human resources and so forth.† Primary information is the original materials which have not been filtered through interpretation, it is someone want to gain some information then he through statistical get conclusion. It is even no evaluation by a second party. â€Å"It is information compiled/generated/created by computer. Secondary information can be deleted and regenerated at any time. Secondary Information is information that is derived from other information.† Secondary information may be after a second use. So it is may no use value 4.5 The research in Britvic Britvic can research its customers. To found the main consumer groups. Britvic can make a questionnaire issue to each human that purchase their products to make the product meet the customers’ need. Then they can find the main consumer groups with Britvic is teen-agers. And then Britvic plan to launch a Tango variant called Tango Clear with no added sugar, designed to attract older consumers. The move can make to improve its current market conditions and have a group of constant consumers. The company also can take some new projects to better meet the needs of customers. The primary research strengths are dealing with problems very accurate, the weakness is time consuming, Britvic can get the original information, but it will take much time and the cost is expensive. However the result of research is more in line with customer demand. Secondary research strengths are fast and easy to get, weaknesses are collected for other, Britvic can easily get a rough answer, but it is easy to get. I suggest the Britvic need a market research before developing Tango Clear in order to figure out the right marketing mix and the wants of customers. With the research, they can avoid the market failure and unnecessary loss. 5.0 Marketing research information collection technique Britvic invention a new product called Tango Clear. This product with no added sugar, designed to attract older consumers. Before this product develops Britvic can have a survey such as questionnaire. This action is Britvic go through survey on consumers tastes preference determined. From the survey, company know what flavor is older customers prefer. So they can development this new product with this survey’s information. Tango has two star flavor products. The two products have an excellent sale. This product is the first time that keep the older customer change their opinion from a product specialized aim at children. Therefore, there will take more customers to buy this product. Then a high brand loyalty has been established. Primary research include: qualitative research and quantitative research. Qualitative research tends to know the opinion and view of people. And the quantitative research tends to find the statistical information. If Britvic used In-depth interviews, they can gain the information clearly and particular. But this way is so expensive and waste too much time. So we do  not recommend Britvic using this method. If Britvic used postal surveys, it is very convenience to the company. But it must need much time to receive reply. Britvic can use a qualitative research techniques that focus group. Britvic need to promote the new product for older customer. So they can only take a survey from older customer. 6.0 Market segmentation and targeting 6.1 market segmentation â€Å"Market segmentation is a marketing term referring to the aggregating of prospective buyers into groups (segments) that have common needs and will respond similarly to a marketing action. Market segmentation enables companies to target different categories of consumers who perceive the full value of certain products and services differently from one another.†   Levels of market segmentation can divide markets into smaller segments. It can be reached more efficiently and effectively with products and services that match their unique needs. Market segmentation represents an effort to increase a companys targeting precision. It include: Mass marketing, it means same product to all consumers; Segment marketing that difference products to one or more segments; Niche marketing that different products to subgroups with in segments; Micromarketing, it means products to suit the tastes of individuals and locations. And the Micromarketing included Local marketing- tailoring brand s/ promotions to local customer group; Individual marketing- Tailoring products and programs to the needs of individual customers. Standards of segmentation: Company can accord age, life, style, etc. to segmentation the market. For example Red Devin, it is a sport energy drinks, It mainly provide physical strength consumption huge young people drinking. So Red Devin’s market has according to age and life. Behavioral segmentation: It is based on variable such as customers usage rate, benefits sought, company brand loyalty, user status, occasions and readiness to buy etc. 6.2 market targeting Target market is defined as being a set of buyers who share common needs or characteristics that the company decides to serve. The selection of potential customers to whom a business wishes to sell products and services is targeting. Successful marketing find a target audiences. Every business set a target after their market research. The targeting involves segmentation the market choosing which segment of the market is appropriate and determining the product that will be offered in each segment. 6.3 The process of marketing segmentation and targeting The process of marketing segmentation The first step in the segmentation process is to establish the market and targeted consumers. The second step is often termed as market mapping and involves structuring the entire marketing procedures based upon the need of the said market. The third step is entirely dependent upon the consumers as the demand by consumers and their suggestions are largely viewed, surveyed, taken into consideration and in many cases implemented. In this step, the actual segment begins to take shape as like-minded consumers having same demands are placed together and are analyzed as a group. Launching of a parallel or a totally new product is viewed in this situation. The last step is catering to the needs of existing consumers and finding new markets. 6.4 benefits of market segmentation and targeting 1) Lower marketing expenses by targeting certain segment. Good for small budget companies; 2) Increase production and marketing efficiency and effectiveness; 3) Increased effectiveness in marketing campaign designed to attract that segment. 4) Improve profitability and enhance market share;  5) Tailoring product offering to a certain market segment improves customer satisfaction. Britvic following all kinds of market segmentation and they are applying market segmentation for targeting. As a result they are getting more and more benefits. They recognize that the Great Depression in UK lead to poorest customers needed an affordable source of Vitamin C and they have made a small glass bottle of juice and the idea was successful from the Geo-Demographic Segmentation. 7.0 Marketing mix in relation to Britvic 7.1 marketing mix The marketing mix is a business tool used in marketing. The marketing mix is often crucial when determining a product or brands offering, and is often  synonymous with the four Ps: price, product, promotion, and place. Product Line: A group of products have similar function, group of customers, distribution channel and price ranges. For example, Britvic have creation different kinds of drink. Product Depth: The more products in a product line are means product line is longer. For example, in one product line of Britvic have many kind of soft drink include lemonades, mineral waters, tonics. Product Length: All production the variety of goods. For example, Britvic have two main products that soft drink and Stills. Product Width: A company the number of the product line. In Britvic have two product lines. The brand of Britvic: Britvic has a constant flow of new product development. Follow different group of customers change their product. It can increase brand loyalty. The factors aff ect the successful launch of the new product in to the market. For example, the product is launched at the wrong time. If Britvic launch a new soft drink at winter, that a wrong time. Because winter is so cold, very few people to buy soft drinks. Therefore this product cannot be successful. 7.2 distribution channel Product distribution (or place) is one of the four elements of the marketing mix. Distribution is the process of making a product or service available for use or consumption by a consumer or business user, using direct means, or using indirect means with intermediaries. The traditional distribution model is Manufacturing, Wholesaler, and Retailer. Intermediaries can save time, minimizing compliance costs, and free you up to focus on whats important building your business. The Britvic’s products present to supermarket, cinemas, Hotel, restaurant and Bar. Britvic supplies a wide range of products to approximately 200,000 outlets across the country. It is extensive sales channels. But it may be a little waste. It can decrease their distribution channel, take them dont be so dense. In a public that population is concentrated; the intermediaries can lay up some vending machines. Price is the main of marketing mix. Because it is must be right price. It is must be high enough to cover costs and make a good profit however at the same time be low price to catch the eye of customers. Pricing strategy which company’s use such as price skimming, price penetration, and competitive.  Price skimming involves setting a high price before other competitors come into the market. This is often used of a new product which is not facing little competition. Price penetration is the pricing method of setting a relatively low initial entry price, usually lower than the intended established price to attract new customers. Influence the pricing strategy’s factors. Competitive: If there is strong competition in a market then the price of product will be same for different products. Products may be good or bad. â€Å"Advertising is a form of communication for marketing and used to encourage or persuade an audience (viewers, readers or listeners; sometimes a specific group) to continue or take some new action.†   Advertising was usually including the type of newspaper, magazines, television commercial, radio advertisement, outdoor advertising or direct mail; or new media such as blogs, websites or text messages. Even if print and cinema are very attract consumers, but those ways is so expensive.TV is a good method, because everybody can see TV at home. Most of products have life cycle. For example, in summer advertisement with soft drink can be decrease. Because summer is so hot, most of people want to drink Cool coke to relieving summer-heat. Even if no advertisement customers don’t forget this product. But government doesn’t allow large-scale advertising. So the company can change their policy, they can Show the exhibits in the magazine covers. And according radio in troduces their products. â€Å"Direct marketing is a channel-agnostic form of advertising that allows businesses and nonprofits organizations to communicate straight to the customer, with advertising techniques that can include Cell Phone Text messaging, email, interactive consumer websites, online display ads, fliers, catalog distribution, promotional letters, and outdoor advertising.† 8.0 Marketing mix from perspective of service Tangible goods have many accompanying services. For example delivery precision, speed, after services, health concerns, customers services hotline, etc. Those accompanying services all can help company have improving goodwill, improving customer satisfaction and brand loyalty. Process is a procedure. It is a mechanism of activities which is involved in the delivery of a service. It means that how a business provides a good service to the customers and to get success. For example, Britvic juices were sold in small glass bottles which ensured easy transportation. This process can make customer feel convenience. This is good service for Britvic. People who serve the customers are the main in a service. People are considering the most important element in any kinds of service so the rule of staff is very important to influences a customer’s perception of the quality of service. Front side who are dealings with customers they must be highly trained and with good knowledge about their product. The company must train staff communication skills. For example: Ralph Chapman. He is owner of the British. Physical Environment Physical environment is very important for any kinds of business. It is an extended marketing strategy which is used to satisfy the customers by the best advertisement, with either tangible products or service. The marketing strategy should include effectively communicating their satisfaction to potential customers because of the intangibility of service. From physical environment the customers want comfort. For example, if manufacturing environment is very well. It is used to satisfy the customers by the best advertisement. On the other hand it will be not only comfortable for the customers but also for staffs. Britvic also can attempts to develop the online marketing. Online marketing is one of the population ways with shopping today. 9.0 Recommendations Britvic is distributing its products to a wide range of areas such as supermarkets, local shops, restaurant, pubs, hotels, and cinemas. If they wanted to, they can distribute their products for a more broad range. They could distribute to wholesalers and give them exclusive offers which are not available elsewhere. They also can door to door promotion for their product. Britvic is a very successful brand and company, so they could use any kinds  of promotional method. For example they have been used Wimbledon and Pantomimes which gives the brand a lot of publicity. However, it can not only make the advertisement through TV, it also can release it on the magazine, paper and subway advertising. Thus more people will know this brand. The sponsor can launch a lot of marketing activities, let more consumer understand this brand Britvic has a long and rich history, so its’ image in peoples hearts are very clear. Its’ price must be in a scope of public satisfaction. But it a lso can have a low-cost product. This action can take people use a low price to enjoy an old brand of products. So this method must be increased the products sales. 10.0 Summary and conclusion The problem of Britvic is poor summer weather has impact the sales. And the health awareness has driven demand, it also impact the sales of soft drink. Britvic can according to the seasonal introduce the corresponding new products. For example, in cold winter they can develop a hot drink. Britvic should sure their marketing objective. It is aim at the vast numbers of young meanwhile attracted older customers. Britvic can accord older costumers’ flavor to develop some new products. 11.0 Reference The websites visited included: http://en.wikipedia.org/wiki/Marketing http://en.wikipedia.org/wiki/Market_environment http://en.wikipedia.org/wiki/Market_environment http://www.wisegeek.com/what-is-market-research.htm http://www.marketresearchworld.net/index.php?option=com_contenttask=viewid=802 http://wiki.answers.com/Q/What_is_primary_information http://c2.com/cgi/wiki?SecondaryInformation http://www.investopedia.com/terms/m/marketsegmentation.asp#ixzz2Cx7YQZWq http://www.buzzle.com/articles/market-segmentation-process.html http://en.wikipedia.org/wiki/Advertising http://en.wikipedia.org/wiki/Direct_marketing

Travel Motivation For Young Tourists

Travel Motivation For Young Tourists Tourism is one of the industries that are significant to the global economy last few decades. Yet, the changing of the travel trend recently leads to the economic growth. The changes are cause by the youth travelling frequency and the travel periods. They tend to travel more frequently and for longer periods, thus these groups of people become an increasingly important segment of the global tourism industry. Richards and Wilson (2003) indicate that, Youth and student travel has been an important cornerstone of the international travel market for over 50 years it is only the recent explosive growth of the international students population that has thrust this market into the spotlight. From the World Tourism Organization (WTO) report as cited in Taiyab (2005), international trips taken by young travelers grew from 14.6% in 1980 to 20% in 2001, and reach 25% in 2005. According to the Federation of International Youth Travel Organizations reports as cited in Kim, Jogaratnam and Noh (2006), from the 140 million of international tourist arrivals per year, 20 percent of them are the young tourists. Youth Travel Market The WTO defines that the young travelers are between 16 to 25 years old who take a trip involving at least one nights stay. However, Canada expanded the definition to include young adults of between 26 to 30 years old (Taiyab, 2005). Taiyab (2005) indicates that youth travel markets are being categorized into 2 independent youth travel and youth group travel. There are different characteristics, motivations and product requirement among these 2 groups to fulfill or suit their needs and wants. Independent youth travel also known as independent youth travelers, free independent youth travelers, foreign independent travelers or backpackers. They usually travel to a place either in a small informal group or alone. Most of them are internet savvy, they will search the information for that particular travel destination via internet, so that the pre-trip planning can be well arranged. The distance of the travel destination normally will be very far away from their home and it takes a longer period because they want to gain experience, increase their knowledge and explore different cultures at different environments. Besides, they tend to be price sensitive for travelling expenses including the food, accommodation and etc. While for the youth travel group, it is formed by a group of 6 young people or more that are travelling together. This category is divided into 2 groups which are the school-based youth group travel and non-school-based youth group travel. Generally, school-based youth group travel is related to the curriculum or co-curricular activities such as school societies, music performance, sport competition, educational tours, cultural exchange trips and so forth. Those activities are carried out in a group structure and accompanied by teachers or school personnel. In the other hand, non-school-based youth group travel is also in a group structure, it may occurred in smaller groups, but the activities are organized by the societies outside of the school such as sports team, church group, cultural or musical performance troupe, Scouts or Girl Guides, youth club and more. The group will be led by parents or other adults. Literature Review of Travel Motivation 2.1 Motivation Gnoth, 1997 (as cited in Yoon and Uysal, 2005) defined that motivation is an internal and external motives. An internal motive is connected with drives, feelings, and instincts while external motive involves mental representations such as knowledge or beliefs. Motivation is the driving force behind all aspects of human behavior (Fodness, 1994, as cited in Petersen, 2009). Motivation is the fundamental for the development of tourism, it could not exist without any interest or the need to travel (Murphy, 1985, as cited in Bonera, n.d.). 2.2 Travel Motivation Travel motivations defined as the global integrating network of biological and cultural forces which gives value and direction to travel choices, behavior and experience (Pearce, Morrison Rutledge, 1998 as cited by Banerjea, n.d.). According to Crompton McKay, 1997, as cited in Petersen, 2009, travel motivation can be understood as a dynamic process of internal psychological factors which create an unbalanced equilibrium in the individual, and this is what brings the person to travel. Tourism motivation is a multi-motive dimensional (Zhang and Marcusen, 2007). When choosing a certain destination, people will often have more than one motive to visit the place. For example, a person may choose Pangkor Island with a motive of relaxation in a pleasant safe place combined with visiting a local historical heritage. The Theory of Travel Motivation Maslows Hierarchy Theory According to Maslow (1943) as cited in Banerjea (n.d) there are five needs to form a hierarchy based on Maslows Hierarchy Theory, progressing from the lower to the higher needs. The lower needs are physiological, safety, belonging and love. Self-esteem and self-actualization would be the higher needs. Maslow stated that if the lower needs are fulfilled, the individual would be motivated by needs and proceeds to the next level of the hierarchy. For example, a person would not travel to the country that is infected by H1N1, he or she will only visit the particular destination whenever it is safe. Four Motivational Needs Beard and Ragheb (1983) as cited in Banerjea (n.d) stated four motivational needs as derived from the work of Maslow (1970) which are the intellectual component, the social component, the competency-mastery component, and the stimulus-avoidance component. Intellectual component assesses the extent of individuals involve in leisure activities such as learning, exploring, discovering, thought or imagining. The social component assesses the extent of individuals engage in leisure activities for social reasons such as the need for friendship and interpersonal relationships and the need for the esteem of others. The competence-mastery component assesses the extent of individuals engage in leisure activities in order to achieve, master, challenge and compete. The stimulus-avoidance component of leisure motivation assesses the drive to escape and get away from over-stimulating life situations such as the need for some individuals to avoid social contacts, to seek solitude and calm condition s and others. Factors that Motivated Young Tourist to Travel Pull and Push Model Dann (1977) as cited in Bonera (2008) proposed a two level scheme of factors that motivate young tourists in the travel decision making process: push and pull factors. Young tourists are motivated to travel because of the pull and pushed factors. The idea of the push-pull model is the decomposition of a young tourists choice of destination into two forces (Bansal and Eiselt, 2004). The internal or psychological forces pushed young tourists to make travel decision while the external forces of the destination attributes pulled young tourists to travel to that particular place (Crompton, 1979; Dann, 1977; Uysal Jurowski, 1994 as cited in Yoon and Uysal, 2005). The pull motivations are more connected to emotional aspects whereas push motivations are related to cognitive aspects (Yoon and Uysal, 2005). Push factors are intangible factors that pushes a tourist away from home, while pull factors are tangible characteristics pulling tourists towards the destination (Andreu, Bigne ´, Coop er, 2000, as cited in Jonsson and Devonish, 2008). Push factors are intrinsic desires of the young tourist such as the desire for escape, rest and relaxation, adventure, health, or prestige while pull factors are related to the attractiveness of a given destination such as beaches, accommodation and recreational facilities, and cultural and historical resources (Uysal and Jurowski 1994 as cited in Chi and Sung, 2008). Reasons of Young Tourist Travel Young tourists have their very own reasons to travel, which the reasons can be internally or externally (McGhee, Loker-Murphy, Uysal, 1996 as cited in Yoon and Uysal, 2005). The young tourist will go for traveling because of push motivations such as the desire for escape (e.g. getting away from school or job, escape from responsibilities, reduce stress, being away from demands at home, get a chance to be free, being physically or emotionally refreshed, experience a simpler lifestyle and etc), rest and relaxation (e.g. doing nothing at all, getting a change from a busy work, to relax, to enjoy good weather and etc), health and fitness (e.g. get close to nature, engage in sports, view sport events and etc), adventure and social interaction (e.g. being daring and adventuresome, finding thrills, meeting new friends and local people, rediscovering oneself and etc) , family togetherness (e.g. visiting friends and relatives, being together as a family, visiting places where family came from and etc), and excitement(e.g. being physically active, finding excitements and etc). The pull motivations that affected the young tourists are sun and beaches (e.g. warm and sunny weather, sea and beaches and etc), natural environment (e.g. rivers/lakes/streams, snow or mountains, beautiful scenery and landscapes, quiet rest area and etc), time and cost (e.g. travel time, good value for the cost, easy accessibility, convenient transportation, availability of information about a destination and etc), cultural and historical resources (e.g. educational opportunities, learning something new or increasing knowledge, experiencing a new culture or new life-style or new destination or exotic food and etc). Conclusion In a nutshell, young tourists are gaining markets in the tourism industry. Tourism industry is become more important to great benefits to the society and enhances economies of each country. It helps to develop the country with the infrastructure development, inflow of foreign currency, increases job opportunities and others. On top of that, the government will focus on the panning, management and evaluation of tourism industry development. Travel becomes more important and indispensable among young people in their live as it can satisfy young people needs and wants. In addition, individual development can be achieved via certain enchantments of the travel such as improving their knowledge, understand the other countries cultural and heritage.

Analysis of Botnet Security Threats

Analysis of Botnet Security Threats CHAPTER 1 INTRODUCTION 1.1 Introduction During the last few decades, we have seen the dramatically rise of the Internet and its applications to the point which they have become a critical part of our lives. Internet security in that way has become more and more important to those who use the Internet for work, business, entertainment or education. Most of the attacks and malicious activities on the Internet are carried out by malicious applications such as Malware, which includes viruses, trojan, worms, and botnets. Botnets become a main source of most of the malicious activities such as scanning, distributed denial-of-service (DDoS) activities, and malicious activities happen across the Internet. 1.2 Botnet Largest Security Threat A bot is a software code, or a malware that runs automatically on a compromised machine without the users permission. The bot code is usually written by some criminal groups. The term â€Å"bot† refers to the compromised computers in the network. A botnet is essentially a network of bots that are under the control of an attacker (BotMaster). Figure 1.1 illustrates a typical structure of a botnet. A bot usually take advantage of sophisticated malware techniques. As an example, a bot use some techniques like keylogger to record user private information like password and hide its existence in the system. More importantly, a bot can distribute itself on the internet to increase its scale to form a bot army. Recently, attackers use compromised Web servers to contaminate those who visit the websites through drive-by download [6]. Currently, a botnet contains thousands of bots, but there is some cases that botnet contain several millions of bots [7]. Actually bots differentiate themselves from other kind of worms by their ability to receive commands from attacker remotely [32]. Attacker or better call it botherder control bots through different protocols and structures. The Internet Relay Chat (IRC) protocol is the earliest and still the most commonly used CC channel at present. HTTP is also used because Http protocol is permitted in most networks. Centralized structure botnets was very successful in the past but now botherders use decentralized structure to avoid single point of failure problem. Unlike previous malware such as worms, which are used probably for entertaining, botnets are used for real financial abuse. Actually Botnets can cause many problems as some of them listed below: i. Click fraud. A botmaster can easily profit by forcing the bots to click on advertisement for the purpose of personal or commercial abuse. ii. Spam production. Majority of the email on the internet is spam. iii. DDoS attacks. A bot army can be commanded to begin a distributed denial-of-service attack against any machine. iv. Phishing. Botnets are widely used to host malicious phishing sites. Criminals usually send spam messages to deceive users to visit their forged web sites, so that they can obtain users critical information such as usernames, passwords. 1.3 Botnet in-Depth Nowadays, the most serious manifestation of advanced malware is Botnet. To make distinction between Botnet and other kinds of malware, the concepts of Botnet have to understand. For a better understanding of Botnet, two important terms, Bot and BotMaster have been defined from another point of views. Bot Bot is actually short for robot which is also called as Zombie. It is a new type of malware [24] installed into a compromised computer which can be controlled remotely by BotMaster for executing some orders through the received commands. After the Bot code has been installed into the compromised computers, the computer becomes a Bot or Zombie [25]. Contrary to existing malware such as virus and worm which their main activities focus on attacking the infecting host, bots can receive commands from BotMaster and are used in distributed attack platform. BotMaster BotMaster is also known as BotHerder, is a person or a group of person which control remote Bots. Botnets- Botnets are networks consisting of large number of Bots. Botnets are created by the BotMaster to setup a private communication infrastructure which can be used for malicious activities such as Distributed Denial-of-Service (DDoS), sending large amount of SPAM or phishing mails, and other nefarious purpose [26, 27, 28]. Bots infect a persons computer in many ways. Bots usually disseminate themselves across the Internet by looking for vulnerable and unprotected computers to infect. When they find an unprotected computer, they infect it and then send a report to the BotMaster. The Bot stay hidden until they are announced by their BotMaster to perform an attack or task. Other ways in which attackers use to infect a computer in the Internet with Bot include sending email and using malicious websites, but common way is searching the Internet to look for vulnerable and unprotected computers [29]. The activities associated with Botnet can be classified into three parts: (1) Searching searching for vulnerable and unprotected computers. (2) Dissemination the Bot code is distributed to the computers (targets), so the targets become Bots. (3) sign-on the Bots connect to BotMaster and become ready to receive command and control traffic. The main difference between Botnet and other kind of malwares is the existence of Command-and-Control (CC) infrastructure. The CC allows Bots to receive commands and malicious capabilities, as devoted by BotMaster. BotMaster must ensure that their CC infrastructure is sufficiently robust to manage thousands of distributed Bots across the globe, as well as resisting any attempts to shutdown the Botnets. However, detection and mitigation techniques against Botnets have been increased [30,31]. Recently, attackers are also continually improving their approaches to protect their Botnets. The first generation of Botnets utilized the IRC (Internet Relay Chat) channels as their Common-and-Control (CC) centers. The centralized CC mechanism of such Botnet has made them vulnerable to being detected and disabled. Therefore, new generation of Botnet which can hide their CC communication have emerged, Peer-to-Peer (P2P) based Botnets. The P2P Botnets do not experience from a single point of failur e, because they do not have centralized CC servers [35]. Attackers have accordingly developed a range of strategies and techniques to protect their CC infrastructure. Therefore, considering the CC function gives better understanding of Botnet and help defenders to design proper detection or mitigation techniques. According to the CC channel we categorize Botnets into three different topologies: a) Centralized; b) Decentralized and c) Hybrid. In Section 1.1.4, these topologies have been analyzed and completely considered the protocols that are currently being used in each model. 1.4 Botnet Topologies According to the Command-and-Control(CC) channel, Botnet topology is categorized into three different models, the Centralized model, the Decentralized model and Hybrid model. 1.4.1 Centralized Model The oldest type of topology is the centralized model. In this model, one central point is responsible for exchanging commands and data between the BotMaster and Bots. In this model, BotMaster chooses a host (usually high bandwidth computer) to be the central point (Command-and-Control) server of all the Bots. The CC server runs certain network services such as IRC or HTTP. The main advantage of this model is small message latency which cause BotMaster easily arranges Botnet and launch attacks. Since all connections happen through the CC server, therefore, the CC is a critical point in this model. In other words, CC server is the weak point in this model. If somebody manages to discover and eliminates the CC server, the entire Botnet will be worthless and ineffective. Thus, it becomes the main drawback of this model. A lot of modern centralized Botnets employed a list of IP addresses of alternative CC servers, which will be used in case a CC server discovered and has been taken offline. Since IRC and HTTP are two common protocols that CC server uses for communication, we consider Botnets in this model based on IRC and HTTP. Figure 1.2 shows the basic communication architecture for a Centralized model. There are two central points that forward commands and data between the BotMaster and his Bots. 1.4.1.1 Botnets based on IRC The IRC is a type of real-time Internet text messaging or synchronous conferencing [36]. IRC protocol is based on the Client Server model that can be used on many computers in distributed networks. Some advantages which made IRC protocol widely being used in remote communication for Botnets are: (i) low latency communication; (ii) anonymous real-time communication; (iii) ability of Group (many-to-many) and Private (one-to-one) communication; (iv) simple to setup and (v) simple commands. The basic commands are connect to servers, join channels and post messages in the channels; (vi) very flexibility in communication. Therefore IRC protocol is still the most popular protocol being used in Botnet communication. In this model, BotMasters can command all of their Bots or command a few of the Bots using one-to-one communication. The CC server runs IRC service that is the same with other standard IRC service. Most of the time BotMaster creates a channel on the IRC server that all the bots can connect, which instruct each connected bot to do the BotMasters commands. Figure 1.3 showed that there is one central IRC server that forwards commands and data between the BotMaster and his Bots. Puri [38] presented the procedures and mechanism of Botnet based on IRC, as shown in Figure. 1.4. Bots infection and control process [38]: i. The attacker tries to infect the targets with Bots. ii. After the Bot is installed on target machine, it will try to connect to IRC server. In this while a random nickname will be generate that show the bot in attackers private channel. iii. Request to the DNS server, dynamic mapping IRC servers IP address. iv. The Bot will join the private IRC channel set up by the attacker and wait for instructions from the attacker. Most of these private IRC channel is set as the encrypted mode. v. Attacker sends attack instruction in private IRC channel. vi. The attacker tries to connect to private IRC channel and send the authentication password. vii. Bots receive instructions and launch attacks such as DDoS attacks. 1.4.1.2 Botnet based on HTTP The HTTP protocol is an additional well-known protocol used by Botnets. Because IRC protocol within Botnets became well-known, internet security researchers gave more consideration to monitoring IRC traffic to detect Botnet. Consequently, attackers started to use HTTP protocol as a Command-and-Control communication channel to make Botnets become more difficult to detect. The main advantage of using the HTTP protocol is hiding Botnets traffics in normal web traffics, so it can easily passes firewalls and avoid IDS detection. Usually firewalls block incoming and outgoing traffic to not needed ports, which usually include the IRC port. 1.4.2 Decentralized model Due to major disadvantage of Centralized model-Central Command-and-Control (CC)-attackers tried to build another Botnet communication topology that is harder to discover and to destroy. Hence, they decided to find a model in which the communication system does not heavily depending on few selected servers and even discovering and destroying a number of Bots. As a result, attackers take advantage of Peer-to-Peer (P2P) communication as a Command-and-Control (CC) pattern which is much harder to shut down in the network. The P2P based CC model will be used considerably in Botnets in the future, and definitely Botnets that use P2P based CC model impose much bigger challenge for defense of networks. In the P2P model, as shown in Fig. 1.6, there is no Centralized point for communication. Each Bot have some connections to the other Bots of the same Botnet and Bots act as both Clients and servers. A new Bot must know some addresses of the Botnet to connect there. If Bots in the Botnet are taken offline, the Botnet can still continue to operate under the control of BotMaster. P2P Botnets aim at removing or hiding the central point of failure which is the main weakness and vulnerability of Centralized model. Some P2P Botnets operate to a certain extent decentralized and some completely decentralized. Those Botnets that are completely decentralized allow a BotMaster to insert a command into any Bots. Since P2P Botnets usually allow commands to be injected at any node in the network, the authentication of commands become essential to prevent other nodes from injecting incorrect commands. For a better understanding in this model, some characteristics and important features of famous P2P Botnets have been mentioned: Slapper: Allows the routing of commands to distinct nodes. Uses Public key and private key cryptography to authenticate commands. BotMasters sign commands with private key and only those nodes which has corresponding public key can verify the commands [42]. Two important weak points are: (a) its list of known Bots contains all (or almost all) of the Botnet. Thus, one single captured Bot would expose the entire Botnet to defenders [42] (b) its sophisticated communication mechanism produces lot traffic, making it vulnerable to monitoring via network flow analysis. Sinit: This Bot uses random searching to discove other Bots to communicate with. It can results in an easy detection due to the extensive probing traffic [34]. Nugache: Its weakness is based on its reliance on a seed list of 22 IP addresses during its bootstrap process [47]. Phatbot: Uses Gnutella cache server for its bootstrap process which can be easily shutdown. Also its WASTE P2P protocol has a scalability problem across a long network [48]. Strom worm: it uses a P2p overnet protocl to control compromised hosts. The communication protocol for this Bot can be classified into five steps, as describes below :[37] i. Connect to Overnet Bots try to join Overnet network. Each Bot initially has hard-coded binary files which is included the IP addresses of P2P-based Botnet nodes. ii. Search and Download Secondary Injection URL Bot uses hard-coded keys to explore for and download the URL on the Overnet network [37]. iii. Decrypt Secondary Injection URL compromised hosts take advantages of a key(hard coded) to decrypt the URL. iv. Download Secondary Injection compromised hosts attempt to download the second injection from a server(probably web server). It could be infected files or updated files or list of the P2P nodes [37]. 1.4.3 Hybrid model The Bots in the Hybrid Botnet are categorized into two groups: 1) Servant Bots Bots in the first group are called as servant Bots, because they behave as both clients and servers, which have static, routable IP addresses and are accessible from the entire Internet. 2) Client Bots Bots in the second group is called as client Bots since they do not accept incoming connections. This group contains the remaining Bots, including:- (a) Bots with dynamically designated IP addresses; (b) Bots with Non-routable IP addresses; and (c) Bots behind firewalls which they cannot be connected from the global Internet. 1.5 Background of the Problem Botnets which are controlled remotely by BotMasters can launch huge denial of service attacks, several infiltration attacks, can be used to spread spam and also conduct malicious activities [115]. While bot army activity has, so far, been limited to criminal activity, their potential for causing large- scale damage to the entire internet is immeasurable [115]. Therefore, Botnets are one of the most dangerous types of network-based attack today because they involve the use of very large, synchronized groups of hosts for their malicious activities. Botnets obtain their power by size, both in their increasing bandwidth and in their reach. As mentioned before Botnets can cause severe network disruptions through huge denial- of-service attacks, and the danger of this interruption can charge enterprises big sums in extortion fees. Botnets are also used to harvest personal, corporate, or government sensitive information for sale on a blooming organized crime market. 1.6 Statement of the Problem Recently, botnets are using new type of command-and-control(CC) communication which is totally decentralized. They utilize peer-to-peer style communication. Tracking the starting point and activity of this botnet is much more complicated due to the Peer-to-Peer communication infrastructure. Combating botnets is usually an issue of discovering their weakness: their central position of command, or CC server. This is typically an IRC network that all bots connect to central point, however with the use of P2P method; we cannot find any central point of command. In the P2P networks each bots in searching to connect other peers which can receive or broadcast commands through network. Therefore, an accurate detection and fighting method is required to prevent or stop such dangerous networks. 1.7 Research Questions a. What are the main differences between centralized and decentralized botnets? b. What is the best and efficient general extensible solution for detecting non-specific Peer-to- Peer botnets? 1.8 Objectives of the Study i. To develop a network-based framework for Peer-to-Peer botnets detection by common behavior in network communication. ii. To study the behavior of bots and recognizing behavioral similarities across multiple bots in order to develop mentioned framework. 1.9 Scope of the Study The project scope is limited to developing some algorithms pertaining to our proposed framework. This algorithms are using for decreasing traffics by filtering it, classifying intended traffics, monitoring traffics and the detection of malicious activities. 1.10 Significance of the study Peer-to-Peer botnets are one of the most sophisticated types of cyber crime today. They give the full control of many computers around to world to exploit them for malicious activities purpose such as spread of virus and worm, spam distribution and DDoS attack. Therefore, studying the behavior of P2P botnets and develop a technique that can detect them is important and high-demanded. 1.11 Summary Understanding the Botnet Command-and-Control(CC) is a critical part in recognizing how to best protect against the overall botnet threat. The CC channels utilized by the Botnets will often show the type and degree of actions an enterprise can follow in either blocking or shutting down a botnet, and the probability of success. It is also obvious that attackers have been trying for years to move away from Centralized CC channels, and are achieving some success using Decentralized(P2P) CC channels over the last 5 or so years. Therefore in this chapter we have defined a classification for better understanding of Botnets CC channels, which is included Centralized, Decentralized, and Hybrid model and tried to evaluate recognized protocols in each of them. Understanding the communication topologies in Botnets is essential to precisely identify, detect and mitigate the ever-increasing Botnets threats. CHAPTER 2 LITERATURE REVIEW 2.1 Introduction Before majority of botnets was using IRC (Internet Relay Chat) as a communication protocol for Command and Control(CC) mechanism. Therefore, many researches tried to develop botnet detection scheme which was based on analysis of IRC traffic [50]. As a result, attackers decided to develop more sophisticated botnets, such as Storm worm and Nugache toward the utilization of P2P networks for CC infrastructures. In response to this movement, researches have proposed various models of botnets detection that are based on P2P infrastructure [5]. One key advantage of both IRC and HTTP Botnet is the use of central Command and Control. This characteristic provides the attacker with very well-organized communication. However, the assets also considers as a main disadvantage to the attacker [8]. The threat of the Botnet can be decreased and possibly omitted if the central CC is taken over or taken down [8]. The method that is starting to come out is P2P structure for Botnet interaction. There is not any centralized centre for P2P botnets. Any nodes in P2P botnet behave as client and server as well. If any point in the network is shut down the botnet still can continue its operation. The storm botnet is one of the main and recognized recent P2P botnets. It customized the overnet P2P file-sharing application which is based on the Kademlia distributed hash table algorithm [55] and exploit it for its CC infrastructure. Recently many researchers specially in the anti-virus community and electronic media concentrated on storm worm [56,57]. 2.2 Background and History A peer-to-peer network is a network of computers that any computer in the network can behave as both a client and a server. Some explanation of peer-to-peer networks does not need any form of centralized coordination. This definition is more comfortable because the attacker may be interested in hybrid architectures [8]. 2.2.1 History The table 2.1 shows a summary of some well-known bots and P2P protocols. The range of time from the first bots, EggDrop, until the Storm Worm P2P bot is newly released. The first non-malicious bot was EggDrop that came up many years ago, and we know it as one of the first IRC bots that came to market. GTBot that have many other categories is another well-known malicious bot, that its variants are IRC client, mIRC.exe[61]. After a while, P2P protocols have been used for Botnet activities. Napster is one of the first bot that used P2P as its communication. Napster built an platform that permit all bots can find each other and share files with each other in the network. In this bot, file sharing has been done in the centralized server that we can say it was not completely a P2P botnet. Therefore, all bots have to upload an index of their files to the centralized server and also if they are looking for other files among all bots, have to search in centralized server. If it can find any file that looking for, then can directly connect to that bot and download what they want. Nowadays, because Napster has been shutdown as their service recognized as illegal service, many other P2P service focusing on avoiding such finding. After few years after Napster, Gnutella protocol came up as the first completely P2P services. Actually after Gnutellas , as shown in Table 2.1, many other P2P protocols have been released, such as Kademilia and Chord. This two new p2p service are using distributed hash table as a method for finding information in the peer-to-peer networks. Agobot is another malicious P2P bot that came up recently and become widespread because of good design and modular code base [61]. Nowadays many researchers are concentrating on P2P bots and there is an anticipation that P2P bots will reach to the stage that Centralized botnets will not been used any more in the future. Table 2.1: P2P based Botnets 2.3 Peers-to-Peer Overlay Networks Overlay networks are categorized into two categories: Structured and Unstructured. All nodes in first category can connect to most X peers regarding some conditions for identification of nodes that those peers want to connect. However in unstructured type there is not any specified limit for the number of peers that they can connect, in spite of the fact that there is not any condition for connecting to other peers. Overnet is a good example of structured p2p networks and Chorf is a good example of unstructured P2P networks. 2.3.1 Brief overview of Overnet One of the popular file sharing networks is Overnet that use for their design use distributed hash table (DHT) algorithm that called Kademlia[55]. Each node produces a 128-bit id for joining the network and also use for sending to other node for introducing itself. Actually each node in the network saves the information about other nodes in order to route query messages. 2.3.2 Brief overview of Gnutella Gnutellas is a unstructured file sharing network. In this network, when a node like n want to connect to a node like m, use a ping message to inform the other node for its presence. As long as node m received ping message, then send it back to other nodes in its neighbor and also send a Pong message to the sender of ping message that was node n. this transaction among node let them to learn about each other. 2.4 Botnet Detection In particular, to compare existing botnet detection techniques, different methods are described and then disadvantages of each method are mentioned respectively. 2.4.1 Honeypot-based tracking Honeypot can be used to collect bots for analyzing its behavior and signatures and also for tracking botnets. But using honeypots have several limitations. The most important limitation is because of limited scale of exploited activities that can track. And also it cannot capture the bots that use the method of propagation other than scanning, such as spam. And finally it can only give report for infection machines that are anticipated and put in the network as trap system. So it means that it can not give a report for those computers that are infected with bot in the network but are not devoted as trap machines. So we can come to this conclusion that generally in this technique we have to wait until one bot in the network infect our system and then we can track or analyze the machine. 2.4.2 Intrusion detection systems Intrusion detection techniques can be categorized into two categories: host-based and network-based solution. Host-based techniques are used for recognizing malware binaries such as viruses. A good example of this type is anti-virus detection systems. However, we know that anti-virus are good for just virus detection. The most important disadvantages of anti-virus are that bots can easily evade the detection technique by changing their signatures easily, because the detection system cannot update their databases consistency. And also bots can disable any anti-virus tools in the system to protect themselves from detection. Network- based intrusion detection system is another method for detection that is used in the field of botnet detection. Snort[67] and Bro[68] are the two well-known signature based detection system that are used currently. They use a database as signatures of famous malicious activities to detect botnets or any other malware. Actually if our objective is using this technique for botnet detection, we have to keep updating the database and recognizing all malware quickly to make a signature of it and add to our database. For solving this solving this problem recently researchers are using anomaly based IDS that can detect malicious activities based on behavior of malware or detection techniques. 2.4.3 Bothunter : Dialog correlation-based Botnet detection This technique developed an evidence-trail approach for detecting successful bot infection with patterns during communication for infection process. In this strategy, bot infection pattern are modeled to use for recognizing the whole process of infection of botnet in the network. All behavior that occur the bot infection such as target scanning, CC establishment, binary downloading and outbound propagation have to model by this method. This method gathers an evidence-trail of connected infection process for each internal machine and then tries to look for a threshold combination of sequences that will convince the condition for bot infection [32]. The BotHunter use snort with adding two anomaly-detection components to it that are SLADE (Statistical payLoad Anomaly Detection Engine) and SCADE (Statistical scan Anomaly Detection Engine). SCADE produce internal and external scan detection warnings that are weighted for criticality toward malware scanning patterns. SLADE perform a byte-distribution payload anomaly detection of incoming packets, providing a matching non-signature approach in inbound exploit detection [32 ]. Slade use an n-gram payload examination of traffics that have typical malware intrusions. SCADE execute some port scan analysis for incoming and outgoing traffics. Actually BotHunter has a link between scan and alarm intrusion that shows a host has been infected. When a adequate sequence of alerts is established to match BotHunters infection dialog model, a comprehensive report is created to get all the related events participants that have a rule in infection dialog [32]. This method provides some important features: i. This technique concentrates on malware detection by IDS-driven dialog correlation. This model shows an essential network processes that occur during a successful bot infection. ii. This technique has one IDS-independent dialog correlation engine and three bot-specific sensors. This technique can automatically produce a report of whole detection of bot, as well as the infection of agent, identification of the computer that has been infected and source of Command and Control centre. 2.4.3.1 Bot infection sequences Actually understanding bot infection life processes is a challenging work for protection of network in the future. The major work in this area is differentiating between successful bot infection and background exploit attempt. For reaching to this point analysis of two-way dialog flow between internal hosts and external hosts (internet) is needed. In a good design network which uses filtering at gateway, the threats of direct exploitations are limited. However, contemporary malware families are highly flexible in their ability to attack vulnerable hosts through email attachments, infected P2P media, and drive-by download infections [32]. 2.4.3.2 Modeling the infection dialog process The bot distribution model can conclude by an analysis of external communication traffics that shows the behavior of relevant botnet. Incoming scan and utilize alarms are not enough to state a winning malware infection, as are assumed that a stable stream of scan and exploit signals will be observed from the way out monitor [32]. Figure 2.1 shows the process of bot infection in BotHunter that used for evaluating network flows through eight stages. This model is almost similar with the model that Rajab et al. presented for IRC detection model. The model that they proposed has early initial scanning that is a preceding consideration happen in form of IP exchange and pointing vulnerable ports. Actually figure 2.1 is not aimed for a strict ordering of infection events that happen during bot infection. The important issue here is that bot dialog processes analysis have to be strong to the absence of some dialog events and must not need strong sequencing on the order in bound dialog is conducted. One solution to solve the problem of sequence order and event is to use a weighted event threshold system that take smallest essential sparse sequences of events under which bot profile statement can be initiated [32]. For instance, it is possible put weighting and threshold system for the look of each event in a way that a smallest set of event is important prior of bot detection. 2.4.3.3 Design and implementation More attention devoted for designing a passive network monitoring system in this part which be able of identifying the bidirectional warning signs when internal hosts are infected with b Analysis of Botnet Security Threats Analysis of Botnet Security Threats CHAPTER 1 INTRODUCTION 1.1 Introduction During the last few decades, we have seen the dramatically rise of the Internet and its applications to the point which they have become a critical part of our lives. Internet security in that way has become more and more important to those who use the Internet for work, business, entertainment or education. Most of the attacks and malicious activities on the Internet are carried out by malicious applications such as Malware, which includes viruses, trojan, worms, and botnets. Botnets become a main source of most of the malicious activities such as scanning, distributed denial-of-service (DDoS) activities, and malicious activities happen across the Internet. 1.2 Botnet Largest Security Threat A bot is a software code, or a malware that runs automatically on a compromised machine without the users permission. The bot code is usually written by some criminal groups. The term â€Å"bot† refers to the compromised computers in the network. A botnet is essentially a network of bots that are under the control of an attacker (BotMaster). Figure 1.1 illustrates a typical structure of a botnet. A bot usually take advantage of sophisticated malware techniques. As an example, a bot use some techniques like keylogger to record user private information like password and hide its existence in the system. More importantly, a bot can distribute itself on the internet to increase its scale to form a bot army. Recently, attackers use compromised Web servers to contaminate those who visit the websites through drive-by download [6]. Currently, a botnet contains thousands of bots, but there is some cases that botnet contain several millions of bots [7]. Actually bots differentiate themselves from other kind of worms by their ability to receive commands from attacker remotely [32]. Attacker or better call it botherder control bots through different protocols and structures. The Internet Relay Chat (IRC) protocol is the earliest and still the most commonly used CC channel at present. HTTP is also used because Http protocol is permitted in most networks. Centralized structure botnets was very successful in the past but now botherders use decentralized structure to avoid single point of failure problem. Unlike previous malware such as worms, which are used probably for entertaining, botnets are used for real financial abuse. Actually Botnets can cause many problems as some of them listed below: i. Click fraud. A botmaster can easily profit by forcing the bots to click on advertisement for the purpose of personal or commercial abuse. ii. Spam production. Majority of the email on the internet is spam. iii. DDoS attacks. A bot army can be commanded to begin a distributed denial-of-service attack against any machine. iv. Phishing. Botnets are widely used to host malicious phishing sites. Criminals usually send spam messages to deceive users to visit their forged web sites, so that they can obtain users critical information such as usernames, passwords. 1.3 Botnet in-Depth Nowadays, the most serious manifestation of advanced malware is Botnet. To make distinction between Botnet and other kinds of malware, the concepts of Botnet have to understand. For a better understanding of Botnet, two important terms, Bot and BotMaster have been defined from another point of views. Bot Bot is actually short for robot which is also called as Zombie. It is a new type of malware [24] installed into a compromised computer which can be controlled remotely by BotMaster for executing some orders through the received commands. After the Bot code has been installed into the compromised computers, the computer becomes a Bot or Zombie [25]. Contrary to existing malware such as virus and worm which their main activities focus on attacking the infecting host, bots can receive commands from BotMaster and are used in distributed attack platform. BotMaster BotMaster is also known as BotHerder, is a person or a group of person which control remote Bots. Botnets- Botnets are networks consisting of large number of Bots. Botnets are created by the BotMaster to setup a private communication infrastructure which can be used for malicious activities such as Distributed Denial-of-Service (DDoS), sending large amount of SPAM or phishing mails, and other nefarious purpose [26, 27, 28]. Bots infect a persons computer in many ways. Bots usually disseminate themselves across the Internet by looking for vulnerable and unprotected computers to infect. When they find an unprotected computer, they infect it and then send a report to the BotMaster. The Bot stay hidden until they are announced by their BotMaster to perform an attack or task. Other ways in which attackers use to infect a computer in the Internet with Bot include sending email and using malicious websites, but common way is searching the Internet to look for vulnerable and unprotected computers [29]. The activities associated with Botnet can be classified into three parts: (1) Searching searching for vulnerable and unprotected computers. (2) Dissemination the Bot code is distributed to the computers (targets), so the targets become Bots. (3) sign-on the Bots connect to BotMaster and become ready to receive command and control traffic. The main difference between Botnet and other kind of malwares is the existence of Command-and-Control (CC) infrastructure. The CC allows Bots to receive commands and malicious capabilities, as devoted by BotMaster. BotMaster must ensure that their CC infrastructure is sufficiently robust to manage thousands of distributed Bots across the globe, as well as resisting any attempts to shutdown the Botnets. However, detection and mitigation techniques against Botnets have been increased [30,31]. Recently, attackers are also continually improving their approaches to protect their Botnets. The first generation of Botnets utilized the IRC (Internet Relay Chat) channels as their Common-and-Control (CC) centers. The centralized CC mechanism of such Botnet has made them vulnerable to being detected and disabled. Therefore, new generation of Botnet which can hide their CC communication have emerged, Peer-to-Peer (P2P) based Botnets. The P2P Botnets do not experience from a single point of failur e, because they do not have centralized CC servers [35]. Attackers have accordingly developed a range of strategies and techniques to protect their CC infrastructure. Therefore, considering the CC function gives better understanding of Botnet and help defenders to design proper detection or mitigation techniques. According to the CC channel we categorize Botnets into three different topologies: a) Centralized; b) Decentralized and c) Hybrid. In Section 1.1.4, these topologies have been analyzed and completely considered the protocols that are currently being used in each model. 1.4 Botnet Topologies According to the Command-and-Control(CC) channel, Botnet topology is categorized into three different models, the Centralized model, the Decentralized model and Hybrid model. 1.4.1 Centralized Model The oldest type of topology is the centralized model. In this model, one central point is responsible for exchanging commands and data between the BotMaster and Bots. In this model, BotMaster chooses a host (usually high bandwidth computer) to be the central point (Command-and-Control) server of all the Bots. The CC server runs certain network services such as IRC or HTTP. The main advantage of this model is small message latency which cause BotMaster easily arranges Botnet and launch attacks. Since all connections happen through the CC server, therefore, the CC is a critical point in this model. In other words, CC server is the weak point in this model. If somebody manages to discover and eliminates the CC server, the entire Botnet will be worthless and ineffective. Thus, it becomes the main drawback of this model. A lot of modern centralized Botnets employed a list of IP addresses of alternative CC servers, which will be used in case a CC server discovered and has been taken offline. Since IRC and HTTP are two common protocols that CC server uses for communication, we consider Botnets in this model based on IRC and HTTP. Figure 1.2 shows the basic communication architecture for a Centralized model. There are two central points that forward commands and data between the BotMaster and his Bots. 1.4.1.1 Botnets based on IRC The IRC is a type of real-time Internet text messaging or synchronous conferencing [36]. IRC protocol is based on the Client Server model that can be used on many computers in distributed networks. Some advantages which made IRC protocol widely being used in remote communication for Botnets are: (i) low latency communication; (ii) anonymous real-time communication; (iii) ability of Group (many-to-many) and Private (one-to-one) communication; (iv) simple to setup and (v) simple commands. The basic commands are connect to servers, join channels and post messages in the channels; (vi) very flexibility in communication. Therefore IRC protocol is still the most popular protocol being used in Botnet communication. In this model, BotMasters can command all of their Bots or command a few of the Bots using one-to-one communication. The CC server runs IRC service that is the same with other standard IRC service. Most of the time BotMaster creates a channel on the IRC server that all the bots can connect, which instruct each connected bot to do the BotMasters commands. Figure 1.3 showed that there is one central IRC server that forwards commands and data between the BotMaster and his Bots. Puri [38] presented the procedures and mechanism of Botnet based on IRC, as shown in Figure. 1.4. Bots infection and control process [38]: i. The attacker tries to infect the targets with Bots. ii. After the Bot is installed on target machine, it will try to connect to IRC server. In this while a random nickname will be generate that show the bot in attackers private channel. iii. Request to the DNS server, dynamic mapping IRC servers IP address. iv. The Bot will join the private IRC channel set up by the attacker and wait for instructions from the attacker. Most of these private IRC channel is set as the encrypted mode. v. Attacker sends attack instruction in private IRC channel. vi. The attacker tries to connect to private IRC channel and send the authentication password. vii. Bots receive instructions and launch attacks such as DDoS attacks. 1.4.1.2 Botnet based on HTTP The HTTP protocol is an additional well-known protocol used by Botnets. Because IRC protocol within Botnets became well-known, internet security researchers gave more consideration to monitoring IRC traffic to detect Botnet. Consequently, attackers started to use HTTP protocol as a Command-and-Control communication channel to make Botnets become more difficult to detect. The main advantage of using the HTTP protocol is hiding Botnets traffics in normal web traffics, so it can easily passes firewalls and avoid IDS detection. Usually firewalls block incoming and outgoing traffic to not needed ports, which usually include the IRC port. 1.4.2 Decentralized model Due to major disadvantage of Centralized model-Central Command-and-Control (CC)-attackers tried to build another Botnet communication topology that is harder to discover and to destroy. Hence, they decided to find a model in which the communication system does not heavily depending on few selected servers and even discovering and destroying a number of Bots. As a result, attackers take advantage of Peer-to-Peer (P2P) communication as a Command-and-Control (CC) pattern which is much harder to shut down in the network. The P2P based CC model will be used considerably in Botnets in the future, and definitely Botnets that use P2P based CC model impose much bigger challenge for defense of networks. In the P2P model, as shown in Fig. 1.6, there is no Centralized point for communication. Each Bot have some connections to the other Bots of the same Botnet and Bots act as both Clients and servers. A new Bot must know some addresses of the Botnet to connect there. If Bots in the Botnet are taken offline, the Botnet can still continue to operate under the control of BotMaster. P2P Botnets aim at removing or hiding the central point of failure which is the main weakness and vulnerability of Centralized model. Some P2P Botnets operate to a certain extent decentralized and some completely decentralized. Those Botnets that are completely decentralized allow a BotMaster to insert a command into any Bots. Since P2P Botnets usually allow commands to be injected at any node in the network, the authentication of commands become essential to prevent other nodes from injecting incorrect commands. For a better understanding in this model, some characteristics and important features of famous P2P Botnets have been mentioned: Slapper: Allows the routing of commands to distinct nodes. Uses Public key and private key cryptography to authenticate commands. BotMasters sign commands with private key and only those nodes which has corresponding public key can verify the commands [42]. Two important weak points are: (a) its list of known Bots contains all (or almost all) of the Botnet. Thus, one single captured Bot would expose the entire Botnet to defenders [42] (b) its sophisticated communication mechanism produces lot traffic, making it vulnerable to monitoring via network flow analysis. Sinit: This Bot uses random searching to discove other Bots to communicate with. It can results in an easy detection due to the extensive probing traffic [34]. Nugache: Its weakness is based on its reliance on a seed list of 22 IP addresses during its bootstrap process [47]. Phatbot: Uses Gnutella cache server for its bootstrap process which can be easily shutdown. Also its WASTE P2P protocol has a scalability problem across a long network [48]. Strom worm: it uses a P2p overnet protocl to control compromised hosts. The communication protocol for this Bot can be classified into five steps, as describes below :[37] i. Connect to Overnet Bots try to join Overnet network. Each Bot initially has hard-coded binary files which is included the IP addresses of P2P-based Botnet nodes. ii. Search and Download Secondary Injection URL Bot uses hard-coded keys to explore for and download the URL on the Overnet network [37]. iii. Decrypt Secondary Injection URL compromised hosts take advantages of a key(hard coded) to decrypt the URL. iv. Download Secondary Injection compromised hosts attempt to download the second injection from a server(probably web server). It could be infected files or updated files or list of the P2P nodes [37]. 1.4.3 Hybrid model The Bots in the Hybrid Botnet are categorized into two groups: 1) Servant Bots Bots in the first group are called as servant Bots, because they behave as both clients and servers, which have static, routable IP addresses and are accessible from the entire Internet. 2) Client Bots Bots in the second group is called as client Bots since they do not accept incoming connections. This group contains the remaining Bots, including:- (a) Bots with dynamically designated IP addresses; (b) Bots with Non-routable IP addresses; and (c) Bots behind firewalls which they cannot be connected from the global Internet. 1.5 Background of the Problem Botnets which are controlled remotely by BotMasters can launch huge denial of service attacks, several infiltration attacks, can be used to spread spam and also conduct malicious activities [115]. While bot army activity has, so far, been limited to criminal activity, their potential for causing large- scale damage to the entire internet is immeasurable [115]. Therefore, Botnets are one of the most dangerous types of network-based attack today because they involve the use of very large, synchronized groups of hosts for their malicious activities. Botnets obtain their power by size, both in their increasing bandwidth and in their reach. As mentioned before Botnets can cause severe network disruptions through huge denial- of-service attacks, and the danger of this interruption can charge enterprises big sums in extortion fees. Botnets are also used to harvest personal, corporate, or government sensitive information for sale on a blooming organized crime market. 1.6 Statement of the Problem Recently, botnets are using new type of command-and-control(CC) communication which is totally decentralized. They utilize peer-to-peer style communication. Tracking the starting point and activity of this botnet is much more complicated due to the Peer-to-Peer communication infrastructure. Combating botnets is usually an issue of discovering their weakness: their central position of command, or CC server. This is typically an IRC network that all bots connect to central point, however with the use of P2P method; we cannot find any central point of command. In the P2P networks each bots in searching to connect other peers which can receive or broadcast commands through network. Therefore, an accurate detection and fighting method is required to prevent or stop such dangerous networks. 1.7 Research Questions a. What are the main differences between centralized and decentralized botnets? b. What is the best and efficient general extensible solution for detecting non-specific Peer-to- Peer botnets? 1.8 Objectives of the Study i. To develop a network-based framework for Peer-to-Peer botnets detection by common behavior in network communication. ii. To study the behavior of bots and recognizing behavioral similarities across multiple bots in order to develop mentioned framework. 1.9 Scope of the Study The project scope is limited to developing some algorithms pertaining to our proposed framework. This algorithms are using for decreasing traffics by filtering it, classifying intended traffics, monitoring traffics and the detection of malicious activities. 1.10 Significance of the study Peer-to-Peer botnets are one of the most sophisticated types of cyber crime today. They give the full control of many computers around to world to exploit them for malicious activities purpose such as spread of virus and worm, spam distribution and DDoS attack. Therefore, studying the behavior of P2P botnets and develop a technique that can detect them is important and high-demanded. 1.11 Summary Understanding the Botnet Command-and-Control(CC) is a critical part in recognizing how to best protect against the overall botnet threat. The CC channels utilized by the Botnets will often show the type and degree of actions an enterprise can follow in either blocking or shutting down a botnet, and the probability of success. It is also obvious that attackers have been trying for years to move away from Centralized CC channels, and are achieving some success using Decentralized(P2P) CC channels over the last 5 or so years. Therefore in this chapter we have defined a classification for better understanding of Botnets CC channels, which is included Centralized, Decentralized, and Hybrid model and tried to evaluate recognized protocols in each of them. Understanding the communication topologies in Botnets is essential to precisely identify, detect and mitigate the ever-increasing Botnets threats. CHAPTER 2 LITERATURE REVIEW 2.1 Introduction Before majority of botnets was using IRC (Internet Relay Chat) as a communication protocol for Command and Control(CC) mechanism. Therefore, many researches tried to develop botnet detection scheme which was based on analysis of IRC traffic [50]. As a result, attackers decided to develop more sophisticated botnets, such as Storm worm and Nugache toward the utilization of P2P networks for CC infrastructures. In response to this movement, researches have proposed various models of botnets detection that are based on P2P infrastructure [5]. One key advantage of both IRC and HTTP Botnet is the use of central Command and Control. This characteristic provides the attacker with very well-organized communication. However, the assets also considers as a main disadvantage to the attacker [8]. The threat of the Botnet can be decreased and possibly omitted if the central CC is taken over or taken down [8]. The method that is starting to come out is P2P structure for Botnet interaction. There is not any centralized centre for P2P botnets. Any nodes in P2P botnet behave as client and server as well. If any point in the network is shut down the botnet still can continue its operation. The storm botnet is one of the main and recognized recent P2P botnets. It customized the overnet P2P file-sharing application which is based on the Kademlia distributed hash table algorithm [55] and exploit it for its CC infrastructure. Recently many researchers specially in the anti-virus community and electronic media concentrated on storm worm [56,57]. 2.2 Background and History A peer-to-peer network is a network of computers that any computer in the network can behave as both a client and a server. Some explanation of peer-to-peer networks does not need any form of centralized coordination. This definition is more comfortable because the attacker may be interested in hybrid architectures [8]. 2.2.1 History The table 2.1 shows a summary of some well-known bots and P2P protocols. The range of time from the first bots, EggDrop, until the Storm Worm P2P bot is newly released. The first non-malicious bot was EggDrop that came up many years ago, and we know it as one of the first IRC bots that came to market. GTBot that have many other categories is another well-known malicious bot, that its variants are IRC client, mIRC.exe[61]. After a while, P2P protocols have been used for Botnet activities. Napster is one of the first bot that used P2P as its communication. Napster built an platform that permit all bots can find each other and share files with each other in the network. In this bot, file sharing has been done in the centralized server that we can say it was not completely a P2P botnet. Therefore, all bots have to upload an index of their files to the centralized server and also if they are looking for other files among all bots, have to search in centralized server. If it can find any file that looking for, then can directly connect to that bot and download what they want. Nowadays, because Napster has been shutdown as their service recognized as illegal service, many other P2P service focusing on avoiding such finding. After few years after Napster, Gnutella protocol came up as the first completely P2P services. Actually after Gnutellas , as shown in Table 2.1, many other P2P protocols have been released, such as Kademilia and Chord. This two new p2p service are using distributed hash table as a method for finding information in the peer-to-peer networks. Agobot is another malicious P2P bot that came up recently and become widespread because of good design and modular code base [61]. Nowadays many researchers are concentrating on P2P bots and there is an anticipation that P2P bots will reach to the stage that Centralized botnets will not been used any more in the future. Table 2.1: P2P based Botnets 2.3 Peers-to-Peer Overlay Networks Overlay networks are categorized into two categories: Structured and Unstructured. All nodes in first category can connect to most X peers regarding some conditions for identification of nodes that those peers want to connect. However in unstructured type there is not any specified limit for the number of peers that they can connect, in spite of the fact that there is not any condition for connecting to other peers. Overnet is a good example of structured p2p networks and Chorf is a good example of unstructured P2P networks. 2.3.1 Brief overview of Overnet One of the popular file sharing networks is Overnet that use for their design use distributed hash table (DHT) algorithm that called Kademlia[55]. Each node produces a 128-bit id for joining the network and also use for sending to other node for introducing itself. Actually each node in the network saves the information about other nodes in order to route query messages. 2.3.2 Brief overview of Gnutella Gnutellas is a unstructured file sharing network. In this network, when a node like n want to connect to a node like m, use a ping message to inform the other node for its presence. As long as node m received ping message, then send it back to other nodes in its neighbor and also send a Pong message to the sender of ping message that was node n. this transaction among node let them to learn about each other. 2.4 Botnet Detection In particular, to compare existing botnet detection techniques, different methods are described and then disadvantages of each method are mentioned respectively. 2.4.1 Honeypot-based tracking Honeypot can be used to collect bots for analyzing its behavior and signatures and also for tracking botnets. But using honeypots have several limitations. The most important limitation is because of limited scale of exploited activities that can track. And also it cannot capture the bots that use the method of propagation other than scanning, such as spam. And finally it can only give report for infection machines that are anticipated and put in the network as trap system. So it means that it can not give a report for those computers that are infected with bot in the network but are not devoted as trap machines. So we can come to this conclusion that generally in this technique we have to wait until one bot in the network infect our system and then we can track or analyze the machine. 2.4.2 Intrusion detection systems Intrusion detection techniques can be categorized into two categories: host-based and network-based solution. Host-based techniques are used for recognizing malware binaries such as viruses. A good example of this type is anti-virus detection systems. However, we know that anti-virus are good for just virus detection. The most important disadvantages of anti-virus are that bots can easily evade the detection technique by changing their signatures easily, because the detection system cannot update their databases consistency. And also bots can disable any anti-virus tools in the system to protect themselves from detection. Network- based intrusion detection system is another method for detection that is used in the field of botnet detection. Snort[67] and Bro[68] are the two well-known signature based detection system that are used currently. They use a database as signatures of famous malicious activities to detect botnets or any other malware. Actually if our objective is using this technique for botnet detection, we have to keep updating the database and recognizing all malware quickly to make a signature of it and add to our database. For solving this solving this problem recently researchers are using anomaly based IDS that can detect malicious activities based on behavior of malware or detection techniques. 2.4.3 Bothunter : Dialog correlation-based Botnet detection This technique developed an evidence-trail approach for detecting successful bot infection with patterns during communication for infection process. In this strategy, bot infection pattern are modeled to use for recognizing the whole process of infection of botnet in the network. All behavior that occur the bot infection such as target scanning, CC establishment, binary downloading and outbound propagation have to model by this method. This method gathers an evidence-trail of connected infection process for each internal machine and then tries to look for a threshold combination of sequences that will convince the condition for bot infection [32]. The BotHunter use snort with adding two anomaly-detection components to it that are SLADE (Statistical payLoad Anomaly Detection Engine) and SCADE (Statistical scan Anomaly Detection Engine). SCADE produce internal and external scan detection warnings that are weighted for criticality toward malware scanning patterns. SLADE perform a byte-distribution payload anomaly detection of incoming packets, providing a matching non-signature approach in inbound exploit detection [32 ]. Slade use an n-gram payload examination of traffics that have typical malware intrusions. SCADE execute some port scan analysis for incoming and outgoing traffics. Actually BotHunter has a link between scan and alarm intrusion that shows a host has been infected. When a adequate sequence of alerts is established to match BotHunters infection dialog model, a comprehensive report is created to get all the related events participants that have a rule in infection dialog [32]. This method provides some important features: i. This technique concentrates on malware detection by IDS-driven dialog correlation. This model shows an essential network processes that occur during a successful bot infection. ii. This technique has one IDS-independent dialog correlation engine and three bot-specific sensors. This technique can automatically produce a report of whole detection of bot, as well as the infection of agent, identification of the computer that has been infected and source of Command and Control centre. 2.4.3.1 Bot infection sequences Actually understanding bot infection life processes is a challenging work for protection of network in the future. The major work in this area is differentiating between successful bot infection and background exploit attempt. For reaching to this point analysis of two-way dialog flow between internal hosts and external hosts (internet) is needed. In a good design network which uses filtering at gateway, the threats of direct exploitations are limited. However, contemporary malware families are highly flexible in their ability to attack vulnerable hosts through email attachments, infected P2P media, and drive-by download infections [32]. 2.4.3.2 Modeling the infection dialog process The bot distribution model can conclude by an analysis of external communication traffics that shows the behavior of relevant botnet. Incoming scan and utilize alarms are not enough to state a winning malware infection, as are assumed that a stable stream of scan and exploit signals will be observed from the way out monitor [32]. Figure 2.1 shows the process of bot infection in BotHunter that used for evaluating network flows through eight stages. This model is almost similar with the model that Rajab et al. presented for IRC detection model. The model that they proposed has early initial scanning that is a preceding consideration happen in form of IP exchange and pointing vulnerable ports. Actually figure 2.1 is not aimed for a strict ordering of infection events that happen during bot infection. The important issue here is that bot dialog processes analysis have to be strong to the absence of some dialog events and must not need strong sequencing on the order in bound dialog is conducted. One solution to solve the problem of sequence order and event is to use a weighted event threshold system that take smallest essential sparse sequences of events under which bot profile statement can be initiated [32]. For instance, it is possible put weighting and threshold system for the look of each event in a way that a smallest set of event is important prior of bot detection. 2.4.3.3 Design and implementation More attention devoted for designing a passive network monitoring system in this part which be able of identifying the bidirectional warning signs when internal hosts are infected with b

The Irrelevance of a College Education Essay -- Educating Education Es

The Irrelevance of a College Education Finding myself a college junior at age 56, I have often thought about why one might want an education in the first place. When asked why it's taken me so long to complete college, well almost complete, my reasons are both simple and complex. I never real ly liked high school that much and my family moved around a lot. As a result, I attended several high schools. In retrospect, I now understand that high school is difficult even if one never moves. But I digress. Why get a college education? Would I be sm arter? More importantly, would people around me think of me as smarter? In fact, did it really matter at all what people around me thought? Was it money then, or pride? Perhaps it was respect. Starting college at night in 1965, I decided to take all the "required courses" to get them out of the way. I don't recall having an advisor back then, nor do I remember asking for one who might have suggested there was no rush in taking the "required co urses" immediately, but rather to take some courses that I might enjoy. So I enrolled in night school and took classes in Western Civilization and Economics. The Western Civ class (as it was called back then) was ok, but the only thing I learned from Econ omics was that the professor cleared his throat 26 times in the course of a minute. Feeling nothing was to be gained in a class where I was counting the clearing of a professor's throat, I dropped out, never bothering to withdraw from the class, but that' s another story. A couple of years later I decided to go back to school. I was a young newlywed at the time, working to put my husband through college, but still convinced I should take the courses I was mandated to have what difference if I en... ...hy? why? why? To me, when we can begin to answer that question, we will all be better off. And more importantly, we should then all be able to answer the question why get a college education? Works Cited Hart, Jeffrey, "How to Get a College Education." Lunsford, Andrea and John Ruszkiewicz, The Presence of Others: Voices and Images That Call for Response 3rd ed. New York: St. Martin's 2000. 126-132. Random House Webster's Unabridged Dictionary, Second Edition. 1999 ed. hooks, bell, "Keeping Close to Home: Class and Education." Lunsford, Andrea and John Ruszkiewicz, The Presence of Others: Voices and Images That Call for Response 3rd ed. New York: St. Martin's 2000. 93-104. Rose, Mike, "Lives on the Boundary." Lunsford, Andrea and John Ruszkiewicz, The Presence of Others: Voices and Images That Call for Response 3rd ed. New York: St. Martin's 2000. 105-119.

School Uniforms Essay -- essays research papers

John Doe walks into a skyscraper, confident and well groomed wearing a tie, suit, and dress shoes. His confidence moves him forward, as he enters an elevator going up to the 23rd floor. He approaches his first job interview since leaving Jesuit Prep: McAllen & McAllen Law. This well groomed man graduated from Jesuit prep, which had a dress code and hair restrictions. This dress code and hair restrictions evolved young men into mature adults over a 4 year period at Jesuit. The dress code and hair restrictions play a vital role for our future as they build class integration, increase our image in the community, and dress the students for business, not play. Jesuit Prep needs to continue this vital dress code and hair restrictions for the future.Having a school full of students wearing the same clothes and hairstyles helps build an integration within the class. Students that wear many different styles of clothes all come together wearing similar pants, shirts, ties, and shoes. Through a dress code and hair restrictions, everyone is helped to be made more comfortable by wearing similar clothes, otherwise, people may feel alienated with less trendy or "cool" clothes. Hairstyles help ease this integration as well by giving each person similar styles making everyone feel more at ease. The overall integration helps the students realize that although people may look similar, the idea that everyone exhibits will be greatly different. These different ideas are present...

Is Fast Food Killing People? Essay

Nowadays obesity has become one of the vital problems in the USA. The quantity of overweight or obese people has been increasing dramatically through the past decades, carrying the raise in number of young people suffering from heart diseases, diabetes and other weight-related diseases. Maintaining healthy weight among the citizens has become one of the most significant tasks for the contemporary health professionals. The nutritionists and therapists name several reasons that lead to obesity in children, adolescents and adults. They say that while the lack of physical activity plays its part in this process, it is mostly improper ration that leads to the progress of this disease. The thing is that most Americans eat more than they should. They overeat every day, and, in addition, their food is mostly high in calories and fat. One of the reasons of this process is that the fast foods are gaining popularity in throughout the USA with each passing year. The excessive consumption of fast foods leads to developing dangerous diseases, which often lead to lethal outcome. A contemporary pace of life often doesn’t allow time for cooking at home, thus the families either eat out, or order food home. It is rarely that families order home healthy foods like salad. Most of Americans prefer pizza, where it is lots off fat and carbohydrates. In addition lots of parents prefer to stock the fridge with high-calorie snacks the children can eat while watching TV or playing computer games. Chocolate bars, soft drinks, and chips are the main ration for many American children. Over and above, there are few kids in the USA that are involved in some kind of physical activity. It’s no wonder the statistic says that 11% of children are obese in the USA and there is also the significant percent of those, who are overweight. (World Heart Federation Fact-Sheet, 2002). The situation with adult obesity is even more threatening. If we consider the fact that being overweigh is having body mass index higher than 25, and obesity is defined as having BMI 30, or greater, the statistical data, gathered in 2003, shows that 39. 8 million American adults, more than 57% are overweight. One-quarter of American adults are also obese. (CDC, 2006) Television and computer games contribute greatly to the weight problems, as today 43% of American adolescents watch TV more than two hours a day, sitting still near the TV set, and often eating snacks. Genetic predisposition factors also shouldn’t be neglected, as their combination with the unhealthy lifestyle usually leads to the severe weight problems. And it is often that obese teenagers become obese adults. Most Americans love fast food, and some of them are dining there two-three times a week. As you understand, no weight loss is possible in such a regime, as the foods offered in McDonalds and similar restaurants are full of empty calories. After a snack in the fast food a person often still feels hungry, even thus he /she consumed twice more calories than he/she needed. As we can see, fast food is one of the factors that determine obesity epidemic that exists in the U. S nowadays. Of course, the McDonalds and other fast food restaurants’ officials try to disprove this fact. Nevertheless, the movie Super Size Me, filmed by Morgan Spurlock, proved it convincingly. Mr. Spurlock, the author and the director of this film, put his own body on the line. He decided to live on nothing, but McDonald’s food, during the entire month. The results were that he gained lots of weight, developed depression, and sugar cravings. As we can se, fast food influences the physical and psychological health of its consumers badly. Healthcare professionals state that consuming fast food leads to obesity, which is one of the causes of diabetes, heart diseases, and other dangerous conditions. Moreover, obesity influences the psychological condition of the patient, leading to development of eating disorders, like Anorexia or Bulimia Nervosa, or Binge eating (Levy, 2000). It is obvious that consuming great amounts of fast food is mortally dangerous. References 1. Center for Disease Control and Prevention. (2006). Overweight and Obesity: Obesity Trends: U. S. Obesity Trends 1985–2004. Retrieved 12 March, 2006 from URL: http://www. cdc. gov/nccdphp/dnpa/obesity/trend/maps/ 2. World Heart Federation (2002). World Heart Federation Fact-Sheet. Obesity/Nutrition. 3. Supersize Me. A film of Epic Portions. (2002). About the Movie. Retrieved 12 March, 2006 from URL: < http://www. supersizeme. com/home. aspx? page=aboutmovie> 4. Levy, L. (2000). Understanding Obesity: The Five Medical Causes. New-York: Firefly Books Ltd. , p. 11.

Hemoglobin Model

Hemoglobin model: note the 02 being carried by molecule. Pipe cleaners=subunits Green marsh mellow=iron molecule Yellow marsh mellow=oxygen molecule Orange cards= heme groups (wolfe, 2000)Oxygenated/deoxygenated oxygenated †¢ 02 bound †¢ Bright red †¢ Subunit is in relaxed form †¢ Higher affinity for 02 †¢ Affinity for oxygen is  cooperative, which means  that the affinity for 02  increases with each bound  molecule. ( Ahern & Rajagopal, 2013)Deoxygenated †¢ 02 not bound †¢ Dark red color †¢ In tense form which has lower affinity for oxygen. †¢ When 02 binds to  deoxygenated hemoglobin,  hemoglobin transitions from T  state to R state. This occurs  when 02 binds to iron, it  causes a change in the  subunit. ( Ahern & Rajagopal,  2013)Bohr Effect Hemoglobin has a high affinity for 02 at a high PH, low Co2. Hemoglobin has a lower affinity at a low PH, high Co2.  At a high Co2, low PH hemoglobin is more stable in the T state which decreases its affinity for 02. Oxygen needs to be delivered to the tissues. Tissues have a low PH. Hemoglobin needs to release 02 at low PH. Low PH = low 02 saturation.  ( Wolfe,2000 )Myoglobin: wants to store 02 for when tissues need it. Has a higher affinity than hemoglobin. ( Ahern & Rajagopal, 2013) Hemoglobin: wants to unload 02 in the tissues. Has a lower affinity than myoglobin. ( Ahern & Rajagopal, 2013 )  (Genetic science learning center, 2013)Difference between normal and sickle forms of hemoglobin.Normal and sickle RBC’s at the cellular level.  (Genetic science learning center, 2013)Diseased RBC’s vs. Normal RBC’s Diseased †¢ Have a sickle shape, and are  thick and sticky. Clumps  together in small blood  vessels. †¢ Blocks normal hemoglobin  to deliver 02 to tissues. †¢ Short life span of 10-20 days †¢ Body can not keep up with rbc production leading to  anemia and pain. (Wolfe,  2000)Normal †¢ Round †¢ Doughnut shape †¢ Life span of 120 days (Wolfe, 2000)  (Ahern and Rajagopal, 2013)