Botnet Control Research Articles

Using honeypots to model botnet attacks on the internet of medical things

Corona Virus Disease 2019 (COVID-19) has led to an increase in attacks targeting widespread smart devices. A vulnerable device can join multiple botnets simultaneously or sequentially. When different attack patterns are mixed with attack records, the security analyst produces an inaccurate report. There are numerous studies on botnet detection, but there is no publicly available solution to classify attack patterns based on the control periods. To fill this gap, we propose a novel data-driven method based on an intuitive hypothesis: bots tend to show time-related attack patterns within the same botnet control period. We deploy 462 honeypots in 22 countries to capture real-world attack activities and propose an algorithm to identify control periods. Experiments have demonstrated our method’s efficacy. Besides, we present eight interesting findings that will help the security community better understand and fight botnet attacks now and in the future.

Botract: abusing smart contracts and blockchain for botnet command and control

Botract: abusing smart contracts and blockchain for botnet command and control

Botract: abusing smart contracts and blockchain for botnet command and control

Botract: abusing smart contracts and blockchain for botnet command and control

Design and Implementation of Automated Steganography Image-Detection System for the KakaoTalk Instant Messenger

As the popularity of social network service (SNS) messengers (such as Telegram, WeChat or KakaoTalk) grows rapidly, cyberattackers and cybercriminals start targeting them, and from various media, we can see numerous cyber incidents that have occurred in the SNS messenger platforms. Especially, according to existing studies, a novel type of botnet, which is the so-called steganography-based botnet (stego-botnet), can be constructed and implemented in SNS chat messengers. In the stego-botnet, by using various steganography techniques, every botnet communication and control (C&C) messages are secretly embedded into multimedia files (such as image or video files) frequently shared in the SNS messenger. As a result, the stego-botnet can hide its malicious messages between a bot master and bots much better than existing botnets by avoiding traditional botnet-detection methods without steganography-detection functions. Meanwhile, existing studies have focused on devising and improving steganography-detection algorithms but no studies conducted automated steganography image-detection system although there are a large amount of SNS chatrooms on the Internet and thus may exist many potential steganography images on those chatrooms which need to be inspected for security. Consequently, in this paper, we propose an automated system that detects steganography image files by collecting and inspecting all image files shared in an SNS chatroom based on open image steganography tools. In addition, we implement our proposed system based on two open steganography tools (Stegano and Cryptosteganography) in the KakaoTalk SNS messenger and show our experimental results that validate our proposed automated detection system work successfully according to our design purposes.

A Framework for Detecting Botnet Command and Control Communication over an Encrypted Channel

Botnet employs advanced evasion techniques to avoid detection. One of the Botnet evasion techniques is by hiding their command and control communication over an encrypted channel like SSL and TLS. This paper provides a Botnet Analysis and Detection System (BADS) framework for detecting Botnet. The BADS framework has been used as a guideline to devise the methodology, and we divided this methodology into six phases: i. data collection, customization, and conversion, ii. feature extraction and feature selection, iii. Botnet prediction and classification, iv. Botnet detection, v. attack notification, and vi. testing and evaluation. We tend to use the machine learning algorithm for Botnet prediction and classification. We also found several challenges in implementing this work. This research aims to detect Botnet over an encrypted channel with high accuracy, fast detection time, and provides autonomous management to the network manager.

Encrypted and covert DNS queries for botnets: Challenges and countermeasures

There is a continuous increase in the sophistication that modern malware exercise in order to bypass the deployed security mechanisms. A typical approach to evade the identification and potential take down of a botnet command and control server is domain fluxing through the use of Domain Generation Algorithms (DGAs). These algorithms produce a vast amount of domain names that the infected device tries to communicate with to find the C&C server, yet only a small fragment of them is actually registered. This allows the botmaster to pivot the control and make the work of seizing the botnet control rather difficult.Current state of the art and practice considers that the DNS queries performed by a compromised device are transparent to the network administrator and therefore can be monitored, analysed, and blocked. In this work, we showcase that the latter is a strong assumption as malware could efficiently hide its DNS queries using covert and/or encrypted channels bypassing the detection mechanisms. To this end, we discuss possible mitigation measures based on traffic analysis to address the new challenges that arise from this approach.

Bot Net of Things – A Survey

Internet of things is talk of the town now a days but the potential threat IoT has over the cyber safety is less emphasized. The possibility for attackers with all systems interconnected with no or less security measures installed in them, makes them vulnerable to all kinds of security attacks. Botnet consists of collection of private computers interconnected together and affected by malicious software, which can be controlled as a group without the owner’s knowledge. BotNet is roBot and Network combination, the bot here is the compromised device. Denial of service, spyware, email spam, click fraud, bit coin etc., and are some of the well-known attacks by botnet. Botnet control itself has become a community, which focuses on prevention, control and repair services. This paper focuses on detailed survey of botnet and it’s regarding features.

Detection of Botnet Command and Control Traffic by the Multistage Trust Evaluation of Destination Identifiers

Detection of Botnet Command and Control Traffic by the Multistage Trust Evaluation of Destination Identifiers

Chord-based Quantum Botnet Research

In order to make the controller better to master the botnet, the traditional chord-based botnets ensure that all adjacent nodes can maintain the periodic communication so that the routing table of every node could keep accurate and efficient. The periodic communication behavior will also increase the risk of exposure of the traditional chord-based botnets. Once one of the peers is captured by network security device, more peers will be captured based on periodic communication behavior of chord-based botnets that leads to affect the botnet robustness. For the aforementioned problems in the traditional chord-based botnet, this paper will construct a quantum botnet control platform based on the improved B92 protocol. The in-depth analysis showed that the infected hosts in the chord-based quantum botnet can more quickly be increased, and can maintain a larger scale compared with the traditional chord-based botnet. So the chord-based quantum botnet owns better robustness and stability.

DNS for Massive-Scale Command and Control

Attackers, in particular botnet controllers, use stealthy messaging systems to set up large-scale command and control. To systematically understand the potential capability of attackers, we investigate the feasibility of using domain name service (DNS) as a stealthy botnet command-and-control channel. We describe and quantitatively analyze several techniques that can be used to effectively hide malicious DNS activities at the network level. Our experimental evaluation makes use of a two-month-long 4.6-GB campus network data set and 1 million domain names obtained from alexa.com. We conclude that the DNS-based stealthy command-and-control channel (in particular, the codeword mode) can be very powerful for attackers, showing the need for further research by defenders in this direction. The statistical analysis of DNS payload as a countermeasure has practical limitations inhibiting its large-scale deployment.

Botnet spoofing: fighting botnet with itself

As the arms race between botmasters and defenders becomes increasingly common, the emerging advanced botnets have evolved to be more resilient to traditional mitigation strategies. For security-conscious Internet users, the host-based security software i.e., antivirus and firewall could provide effective protection against the botnet attacks; however, the remaining security-unconscious users will suffer from the botnet attacks and will be compromised easily. Consequently, how to protect both security-conscious and security-unconscious users against advanced botnets without any command and control vulnerability has posed a great challenge to this day. In this paper, we propose the idea of botnet spoofing that aims at addressing the aforementioned challenge to some degree. Botnet spoofing exploits the essential property of a persistent bot that it MUST obtain its file path before subsequent autostart registration or self-propagation to spoof a specific bot and trick the specific bot to propagate BotSpoofer instead of propagating itself, consequently making the victim not only avoid an originally successful attack but also achieve extra protection provided by BotSpoofer. Thus, botnet spoofing is independent of the vulnerability, protocol, and structure of botnet command and control. To prove the feasibility of botnet spoofing, we create a prototype named ConSpoofer-targeting Conficker. The results show that ConSpoofer could be passively delivered to other victims, which are located by Conficker, through Conficker's three propagation methods in an automatic, simple, accurate, and scalable manner. The goal of our work is to provide a new mitigation strategy that will promote the development of more efficient countermeasures against advanced botnets. Copyright © 2013 John Wiley & Sons, Ltd.

Dynamic Deploying Distributed Low-interaction Honeynet

Distributed virtual honeynet is an important security detection system to Worms, Botnet detection, Spam and Distributed Denial-Of-Service. The honeynet value significantly relies on the disguise capacity. The traditional deploying method is a static scheme that the configuration of honeynet is determined by security experts beforehand and unable to change after the deployment. The hackers or Botnet controllers identify the honeynet and may not trap into the same honeynet again. Therefore, the static deploying honeynet has relatively poor disguise capacity. To improve the disguise capacity, a novel dynamic deploying method is proposed that is capable of redeploying the honeynet in real time. The inducing degree is introduced to measure the disguise capacity by analyzing the inbound and outbound packets of the honeynet. When the inducing degree is less than a specific threshold, the dynamic deploying manager will be activated and to execuate the dynamic deploying algorithms. We have developed three novel dynamic deploying algorithms to solve the problem how to redeploy the honeynet and implemented a prototype for distributed virtual honeynet based on Honeyd. The experimental results of the simulation and real networks datasets demonstrate that the dynamic deploying approach is effective to enhance the disguise capacity of honeynet.

Statistical Characterization of the Botnets C&C Traffic

Botnets are used for various purposes, most of them related to illegitimate activity, being also the sources of massive exploit activity as they recruit new vulnerable systems to expand their reach. Due to their volume, diverse capabilities and robustness, botnets pose a significant and growing threat to enterprise networks and to the Internet itself. Detecting botnets is a hard task and traditional network security systems are unable to successfully complete it. In fact, botnets are evolving and can be quite flexible: the protocols used for Command and Control (C&C) evolved from traditional IRC to others and the structure moved from centralized to distributed, using for example the Peer-to-Peer (P2P) communication paradigm. So, new generation botnet detection systems should be independent of the C&C protocol, botnet structure, infection model and resilient to the change of C&C server addresses. In addition, they should use all available information (from network probes, servers, routing elements, traffic statistics, identification of illicit applications), correlating it in the most useful way. Characterizing existing botnets is crucial to design and efficient detection methodology. Several approaches can be taken to study this phenomenon: analyze its source code, which can be a hard task mainly due to license restrictions; study of the botnet control, particularly the activity of its C&C server(s); study of the botnet behavior, namely its possible scanning activities, Denial of Service (DoS) attacks, spamming or phishing activities, among other possibilities. This work will mainly use the last two approaches to characterize (i) the traffic generated by each bot when communicating with the C&C server(s) and (ii) identify and analyze the main patterns of the botnet generated traffic.

The Analysis of a Botnet Based on HTTP Protocol

Botnet is a kind of computer clusters which hackers have controlled by one to many command channels for malicious purposes. Using a botnet, hacker can conduct the denial of service attacks, send massive spam and steal confidential personal easily. A Botnet's control channel by the initial based on IRC protocol has become complicated channel based on HTTP. This paper introduces the control mechanism of HTTP-based botnet. In addition, this paper also analyzes a kind of botnet based on http protocol--Zeus. By setting up experimental environment, configuring Zeus tool and analyzing network traffic, we are able to understand the working mechanism of Zeus and the working principle of botnet based on HTTP protocol.

Measuring the botnet using the second character of bots

Botnets have become one of the most serious threats to the Internet. They are now the key platform for many Internet attacks, such as spa m, distributed denial-of-service(DDoS), and we call these attacks “the second character of bots”. I n this paper, we focus on characterizing spamming botnets by leveraging both spam payload and spam nodes traffic properties. M easurement of botnets is an important and challenging work. H owever, most existing approaches work only o n specific botnet command and control (c&c) protocols (e.g., IRC) and structures (e.g., centralized). I n this paper, we present two measurement frameworks (MFNL and MFAL) that based on the second character of bots to measure the size of the botnet. W e have easily implemented our prototype system and evaluated it using many real network traces , and we also compare these two app r oaches from several points.

Design and implementation of partially decentralized P2P Botnet control server

The control server is the most important core part of partially decentralized P2P Botnet.The authors designed and implemented the partially decentralized P2P Botnet control server based on the select model of Socket.The primary functions and the relation of them were introduced in detail.The work flow and important data structure were presented.Compared with the traditional IRC Botnet and decentralized P2P Botnet,the differences on occupation of resource,speed of message transmission,control mode,and so on were discussed.According to the result of experiment,both function and capability of this control server meet the need of decentralized P2P Botnet.

Finding Cardinality Heavy-Hitters in Massive Traffic Data and Its Application to Anomaly Detection

We propose an algorithm for finding heavy hitters in terms of cardinality (the number of distinct items in a set) in massive traffic data using a small amount of memory. Examples of such cardinality heavy-hitters are hosts that send large numbers of flows, or hosts that communicate with large numbers of other hosts. Finding these hosts is crucial to the provision of good communication quality because they significantly affect the communications of other hosts via either malicious activities such as worm scans, spam distribution, or botnet control or normal activities such as being a member of a flash crowd or performing peer-to-peer (P2P) communication. To precisely determine the cardinality of a host we need tables of previously seen items for each host (e. g., flow tables for every host) and this may infeasible for a high-speed environment with a massive amount of traffic. In this paper, we use a cardinality estimation algorithm that does not require these tables but needs only a little information called the cardinality summary. This is made possible by relaxing the goal from exact counting to estimation of cardinality. In addition, we propose an algorithm that does not need to maintain the cardinality summary for each host, but only for partitioned addresses of a host. As a result, the required number of tables can be significantly decreased. We evaluated our algorithm using actual backbone traffic data to find the heavy-hitters in the number of flows and estimate the number of these flows. We found that while the accuracy degraded when estimating for hosts with few flows, the algorithm could accurately find the top-100 hosts in terms of the number of flows using a limited-sized memory. In addition, we found that the number of tables required to achieve a pre-defined accuracy increased logarithmically with respect to the total number of hosts, which indicates that our method is applicable for large traffic data for a very large number of hosts. We also introduce an application of our algorithm to anomaly detection. With actual traffic data, our method could successfully detect a sudden network scan.

Killer spam: clawing at your door

Ever-escalating spam levels are close to tearing the commercial guts out of any business and organisation that relies on email as a primary method of business communication. Action is needed now - at governmental levels - if the spam menace is not to undermine global economies. The growing army of zombie computers must be defeated now if we are to control spam in the future. Botnet controllers have better business continuity plans than many e-commerce businesses.