SYSTEMATIC LITERATURE REVIEW ON MALICIOUS COMMAND AND CONTROL: TYPES, TECHNIQUES, TOOLS, CHALLENGES AND RESEARCH DIRECTIONS

Abstract

Malicious Command and Control (C2) traffic is a critical enabler of modern cyberattacks, allowing remote management of compromised systems. This paper presents a systematic literature review (SLR) of 14 primary studies published between 2014 and 2025, identified via a structured PRISMA process across six databases (IEEE, ACM, EEE Xplore, etc.). The review synthesizes six dominant C2 models—centralized, P2P, DGA, fast-flux, cloud abuse, and encrypted traffic—and evaluates detection methods including DNS entropy and machine learning. Results indicate that while detection accuracy for P2P and DGA has improved, encrypted traffic and cloud-based C2 remain significant blind spots. We identify a critical need for explainable AI (XAI) and metadata-based analysis. This review provides a roadmap for researchers and practitioners to develop more resilient, automated threat detection frameworks.