Compromised Machines Research Articles

Spam Zombie Detection and Blocking Mechanism

One of the key security threats on the Internet are called Compromised machines. The compromised machines in the network are recognize or distinguish using SPOT algorithm. SPOT algorithm is worked on The basis of powerful statistical tool called as Sequential Probability Ratio Test (SPRT) (1). The Proposed system Spam Zombie Detection and Blocking Mechanism is an online spam zombie detection system in network which designed with Iterative Dichotomiser 3 (ID3) type logic which will increase the existing system performance and efficiency along with the detection it will also blocks the zombie system detected within the network. Proposed system is designed for the private mailing system. It also try to provide the enhanced security mechanism by blocking hacked machines.

A Taxonomy of Domain-Generation Algorithms

Domain-generation algorithms (DGAs) allow attackers to manage infection-spreading websites and command-and-control (CaC) deployments by altering domain names on a timely basis. DGAs have made the infection and CaC architecture more robust and supportive for attackers. This detailed taxonomy of DGAs highlights the problem and offers solutions to combat DGAs through detection of drive-by download and CaC activity from the compromised machine.

On the Internal Workings of Botnets: A Review

Denial of Service and Distributed Denial of Service Attacks have significantly shackled the development of computer networks and the internet, and masked their innumerable benefits behind many hours of service unavailability. These attacks are fostered, especially in their distributed variant, by networks of compromised machines (known as botnets, that is, a network of bots) that are taken over by a hacker / attacker, and coordinated in such a way as to channel overwhelming loads of malicious or useless traffic towards resource-providing / request-servicing servers. In the long run, a sufficient load of these traffic, overwhelm target servers and constitute them unable to service the requests of legitimate users that have subscribed legally to use these resources. This army of compromised systems have also been recently linked to various malicious and nefarious activities that have been taking place on computer networks and the internet in recent times; such activities relate to malware injection / infiltration, fraud, espionage, amongst others. This paper reviews the operations and coordination of botnets and the interactions that take place within the botnet during such malicious activities. New, valuable insights are provided towards the detection of such malicious networks through the introduction of the reverse life cycle of botnets.

Collaborative 'many to many' DDoS detection in cloud

Cloud computing provides a scalable and cost-effective environment for users to store and process data through the internet. However, it also causes distributed denial-of-service (DDoS) attacks. DDoS attacks risk systems outage and intend to disable the service to legitimate users. In this paper, due to the nature of its large-scale and coordinated attacks, we propose a collaborative prediction approach for detecting DDoS. Our approach provides a clean and direct solution to attack defense. The DDoS attacks follow certain patterns when employing a large number of compromised machines to request for service from the servers in the victim system. So we construct an attacker-server utility matrix by the number of packets and adopt matrix factorisation to detect potential attackers collaboratively. We derive the latent attacker vectors and latent server vectors to predict the unknown entries in the matrix. Experimental results on the NS-2 simulation networks demonstrate the superiority of our approach.

Insights from terrorism intelligence and eradication efforts - Al-Qaeda, ISIS, Boko Haram - for more pragmatic botnet countermeasures

Bots are fast becoming the infamous insurgents lurking around network infrastructures and the internet, with arguably at least one of such compromised machines sitting in homes and offices around the world. These malicious network tenants have shown similar resilience to such real-life terrorist networks as ISIS, Al-Qaeda, Boko Haram, and other armed conflict groups. This paper discusses perspectives, and provides insights into how Botnets are not very different from real-life terrorist networks, and why similar efforts to those which have been used to laudably impair and destabilise terrorist networks globally can equally be applied towards ridding network infrastructures and the internet of these malignant insurgents (especially those of the order of sophistication of Conficker). A review of existing literature juxtaposed with verifiable facts put together from an interpretivist and analytical standpoint, form the crux of the methodology that is used in investigating the cardinal discourse of this study.

Collaborative 'many to many' DDoS detection in cloud

Cloud computing provides a scalable and cost-effective environment for users to store and process data through the internet. However, it also causes distributed denial-of-service DDoS attacks. DDoS attacks risk systems outage and intend to disable the service to legitimate users. In this paper, due to the nature of its large-scale and coordinated attacks, we propose a collaborative prediction approach for detecting DDoS. Our approach provides a clean and direct solution to attack defense. The DDoS attacks follow certain patterns when employing a large number of compromised machines to request for service from the servers in the victim system. So we construct an attacker-server utility matrix by the number of packets and adopt matrix factorisation to detect potential attackers collaboratively. We derive the latent attacker vectors and latent server vectors to predict the unknown entries in the matrix. Experimental results on the NS-2 simulation networks demonstrate the superiority of our approach.

A novel cyber security capability: Inferring Internet-scale infections by correlating malware and probing activities

This paper presents a new approach to infer worldwide malware-infected machines by solely analyzing their generated probing activities. In contrary to other adopted methods, the proposed approach does not rely on symptoms of infection to detect compromised machines. This allows the inference of malware infection at very early stages of contamination. The approach aims at detecting whether the machines are infected or not as well as pinpointing the exact malware type/family. The latter insights allow network security operators of diverse organizations, Internet service providers and backbone networks to promptly detect their clients’ compromised machines in addition to effectively providing them with tailored anti-malware/patch solutions. To achieve the intended goals, the proposed approach exploits the darknet Internet space and initially filters out misconfiguration traffic targeting such space using a probabilistic model. Subsequently, the approach employs statistical methods to infer large-scale probing activities as perceived by the dark space. Consequently, such activities are correlated with malware samples by leveraging fuzzy hashing and entropy based techniques. The proposed approach is empirically evaluated using a recent 60 GB of real darknet traffic and 65 thousand real malware samples. The results concur that the rationale of exploiting probing activities for worldwide early malware infection detection is indeed very promising. Further, the results, which were validated using publically available data resources, demonstrate that the extracted inferences exhibit noteworthy accuracy and can generate significant cyber security insights that could be used for effective mitigation.

Data Randomization and Cluster-Based Partitioning for Botnet Intrusion Detection

Botnets, which consist of remotely controlled compromised machines called bots, provide a distributed platform for several threats against cyber world entities and enterprises. Intrusion detection system (IDS) provides an efficient countermeasure against botnets. It continually monitors and analyzes network traffic for potential vulnerabilities and possible existence of active attacks. A payload-inspection-based IDS (PI-IDS) identifies active intrusion attempts by inspecting transmission control protocol and user datagram protocol packet's payload and comparing it with previously seen attacks signatures. However, the PI-IDS abilities to detect intrusions might be incapacitated by packet encryption. Traffic-based IDS (T-IDS) alleviates the shortcomings of PI-IDS, as it does not inspect packet payload; however, it analyzes packet header to identify intrusions. As the network's traffic grows rapidly, not only the detection-rate is critical, but also the efficiency and the scalability of IDS become more significant. In this paper, we propose a state-of-the-art T-IDS built on a novel randomized data partitioned learning model (RDPLM), relying on a compact network feature set and feature selection techniques, simplified subspacing and a multiple randomized meta-learning technique. The proposed model has achieved 99.984% accuracy and 21.38 s training time on a well-known benchmark botnet dataset. Experiment results demonstrate that the proposed methodology outperforms other well-known machine-learning models used in the same detection task, namely, sequential minimal optimization, deep neural network, C4.5, reduced error pruning tree, and randomTree.

English

In this paper we aim to detect the compromised machines in a network that are involved in the spamming activities, widely known as spam zombies. Given that spamming provides a key economic incentive for attackers to recruit the large number of compromised machine, we develop a spam zombie detection system named SPOT by keeping track of outgoing messages in a network. SPOT is designed based on a powerful statistical tool called Sequential Probability Ratio Test (SPRT), which has bounded false positive and false negative error rates.

Data mining-based integrated network traffic visualization framework for threat detection

In this speedy and voluminous digital world, the threat detection and reporting are a challenging job for rapid action. The present study deals with a strong and viable solution to overcome different threats, network security using data mining approach and techniques through visual graphical representation. Current research study explained and proposed a novel approach named as `integrated network traffic visualization system'. Nevertheless, current framework is working and based on data mining, further help out to demonstrates two new visualization schemes called as: Firstly Grid and secondly Platter. Per framework results, the Grid view is capable of displaying network traffic in different classified grids, based on application layer protocols. Additionally, Platter view visualizes campus area wireless network traffic on a single screen mechanized automatically adjusted with network size. These active schemes are significantly effective to identify and monitor the compromised machines and cuts down reaction time.

Efficiently Securing Systems from Code Reuse Attacks

Code reuse attacks (CRAs) are recent security exploits that allow attackers to execute arbitrary code on a compromised machine. CRAs, exemplified by return-oriented and jump-oriented programming approaches, reuse fragments of the library code, thus avoiding the need for explicit injection of attack code on the stack. Since the executed code is reused existing code, CRAs bypass current hardware and software security measures that prevent execution from data or stack regions of memory. While software-based full control flow integrity (CFI) checking can protect against CRAs, it includes significant overhead, involves non-trivial effort of constructing a control flow graph, relies on proprietary tools and has potential vulnerabilities due to the presence of unintended branch instructions in architectures such as x86—those branches are not checked by the software CFI. We propose branch regulation (BR), a lightweight hardware-supported protection mechanism against the CRAs that addresses all limitations of software CFI. BR enforces simple control flow rules in hardware at the function granularity to disallow arbitrary control flow transfers from one function into the middle of another function. This prevents common classes of CRAs without the complexity and run-time overhead of full CFI enforcement. BR incurs a slowdown of about 2% and increases the code footprint by less than 1% on the average for the SPEC 2006 benchmarks.

A Markov Decision Process Model for High Interaction Honeypots

Honeypots, which are traps designed to resemble easy-to- compromise computer systems, have become essential tools for security professionals and researchers because of their significant contribution in disclosing the underworld of cybercrimes. However, recent years have witnessed the development of several anti-honeypot technologies. Botmasters can exploit the fact that honeypots should not participate in illegal actions by commanding the compromised machine to act maliciously against specific targets which are used as sensors to measure the execution of these commands. A machine that is not allowing the execution of such attacks is more likely to be a honeypot. Consequently, honeypot operators need to choose the optimal response that balances between being disclosed and being liable for participating in illicit actions. In this paper, we consider the optimal response strategy for honeypot operators. In particular, we model the interaction between botmasters and honeypots by a Markov Decision Process (MDP) and then determine the optimal policy for honeypots responding to the commands of botmasters. The model is then extended using a Partially Observable Markov Decision Process (POMDP) which allows operators of honeypots to model the uncertainty of the honeypot state as determined by botmasters. The analysis of our model confirms that exploiting the legal liability of honeypots allows botmasters to have the upper hand in their conflict with honeypots. Despite this deficiency in current honeypot designs, our model can help operators of honeypots determine the optimal strategy for responding to botmasters’ commands. We also provide simulation results that show the honeypots’ optimal response strategies and their expected rewards under different attack scenarios.

Mining Botnets and Their Evolution Patterns

The botnet is the network of compromised computers that have fallen under the control of hackers after being infected by malicious programs such as trojan viruses. The compromised machines are mobilized to perform various attacks including mass spamming, distributed denial of service (DDoS) and additional trojans. This is becoming one of the most serious threats to the Internet infrastructure at present. We introduce a method to uncover compromised machines and characterize their behaviors using large email logs. We report various spam campaign variants with different characteristics and introduce a statistical method to combine them. We also report the long-term evolution patterns of the spam campaigns.

Efficient Detection of SPAM messages and SPAM zombies in the Internet using Naïve-Bayesian and Sequential Probability Ratio Test (SPRT)

The Internet is a global system of interconnected computer networks that provides the communication to serve billions of users worldwide. Compromised machines in the internet allows the attackers to launch various security attacks such as DDoS, spamming, and identity theft. Compromised machines are the one of the major security threat on the internet. In this paper we address this issue by using Naïve-Bayesian and SPRT to automatically identify compromised machines in a network. Spamming allows the attackers to recruit the large number of compromised machines to generate the SPAM messages by hiding the identity, these compromised machines commonly known as spam zombies. We used Naïve-Bayesian and manual methods to detect the SPAM messages and used SPRT technique to identify the spam zombies from the SPAM messages. We proved that the Naïve-Bayesian approach minimizes the error rate, false positives and false negatives compared to the manual approach in the process of detecting SPAM message. Our evaluation studies based on one day email trace collected in our organization network that shows Naïve-Bayesian and SPRT are the effective and efficient systems in automatically detecting SPAM messages and compromised machines in a network.

Monitoring the Spread of Active Worms in Internet

As far as security is concerned compromised system plays a vital role i.e., system connected with a network and which is used to send spamming, malware, identity theft etc. A System is developed mainly to focus on detection of compromised machines which is already being affected by hacker or cracker and used for anti social activities. We have developed an effective solution for detecting compromised system named SPOT. SPOT uses SPRT (Sequence probability ratio test) which has false positive and false positive error rates. This SPOT is an effective and efficient system in detecting compromised machines in the network. To implement a single remote address corresponds to a malicious scanner which works good in internet environments. The main objective are effectively identifying the spam zombies and Denial of Services attack using SPOT without any botnet spam signatures techniques on the network. Keywords- Compromised machines, Malicious scanner, Spam filter, Machine creation, dynamic ip, Spam zombies.

Branch regulation

Code reuse attacks (CRAs) are recent security exploits that allow attackers to execute arbitrary code on a compromised machine. CRAs, exemplified by return-oriented and jump-oriented programming approaches, reuse fragments of the library code, thus avoiding the need for explicit injection of attack code on the stack. Since the executed code is reused existing code, CRAs bypass current hardware and software security measures that prevent execution from data or stack regions of memory. While software-based full control flow integrity (CFI) checking can protect against CRAs, it includes significant overhead, involves non-trivial effort of constructing a control flow graph, relies on proprietary tools and has potential vulnerabilities due to the presence of unintended branch instructions in architectures such as x86---those branches are not checked by the software CFI. We propose branch regulation (BR), a lightweight hardware-supported protection mechanism against the CRAs that addresses all limitations of software CFI. BR enforces simple control flow rules in hardware at the function granularity to disallow arbitrary control flow transfers from one function into the middle of another function. This prevents common classes of CRAs without the complexity and run-time overhead of full CFI enforcement. BR incurs a slowdown of about 2% and increases the code footprint by less than 1% on the average for the SPEC 2006 benchmarks.

Detecting Spam Zombies by Monitoring Outgoing Messages

Compromised machines are one of the key security threats on the Internet; they are often used to launch various security attacks such as spamming and spreading malware, DDoS, and identity theft. Given that spamming provides a key economic incentive for attackers to recruit the large number of compromised machines, we focus on the detection of the compromised machines in a network that are involved in the spamming activities, commonly known as spam zombies. We develop an effective spam zombie detection system named SPOT by monitoring outgoing messages of a network. SPOT is designed based on a powerful statistical tool called Sequential Probability Ratio Test, which has bounded false positive and false negative error rates. In addition, we also evaluate the performance of the developed SPOT system using a two-month e-mail trace collected in a large US campus network. Our evaluation studies show that SPOT is an effective and efficient system in automatically detecting compromised machines in a network. For example, among the 440 internal IP addresses observed in the e-mail trace, SPOT identifies 132 of them as being associated with compromised machines. Out of the 132 IP addresses identified by SPOT, 126 can be either independently confirmed (110) or highly likely (16) to be compromised. Moreover, only seven internal IP addresses associated with compromised machines in the trace are missed by SPOT. In addition, we also compare the performance of SPOT with two other spam zombie detection algorithms based on the number and percentage of spam messages originated or forwarded by internal machines, respectively, and show that SPOT outperforms these two detection algorithms.

Detecting Malicious Fast Flux Domains

Fast-flux service networks (FFSN) are new emerging phenomenon in the internet. Fast-flux networks use proxy networks of compromised machines to redirect and host scam service to achieve high availability. Such technique helps scam websites to avoid being traced and taken down by security professionals. In this paper, we use alternative decision tree algorithm to identify presence of fast-flux domains by analyzing only one address record (A-record) of DNS lookup, which achieves fast detection.

Dempster-Shafer Evidence Combining for (Anti)-Honeypot Technologies

ABSTRACT Honeypots are network surveillance architectures designed to resemble easy-to-compromise computer systems. They are deployed to trap hackers in order to help security professionals capture, control, and analyze malicious Internet attacks and other activities of hackers. A botnet is an army of compromised computers controlled by a bot herder and used for illicit financial gain. Botnets have become quite popular in recent Internet attacks. Since honeypots have been deployed in many defense systems, attackers constructing and maintaining botnets are forced to find ways to avoid honeypot traps. In fact, some researchers have even suggested equipping normal machines by misleading evidence so that they appear as honeypots in order to scare away rational attackers. In this paper, we address some aspects related to the problem of honeypot detection by botmasters. In particular, we show that current honeypot architectures and operation limitations may allow attackers to systematically collect, combine, and analyze evidence about the true nature of the machines they compromise. In particular, we show how a systematic technique for evidence combining such as Dempster-Shafer theory can allow botmasters to determine the true nature of compromised machines with a relatively high certainty. The obtained results demonstrate inherent limitations of current honeypot designs. We also aim to draw the attention of security professionals to work on enhancing the discussed features of honeypots in order to prevent them from being abused by botmasters.

Botnet Command Detection using Virtual Honeynet

Internet attacks are growing with time, threats are increasing to disable infrastructure to those that also target peoples and organization, these increasing large attacks, and the new class of attacks directly targets the large businesses and governments around the world. At the centre of many of these attacks is a large pool of compromised computers which are called zombies commonly controlled by the attackers by using some common channels? Attackers use these zombies as anonymous proxies to hide their real identities and amplify their attacks. A botnet is a network of compromised machines that can be remotely controlled by an attacker. With the view of affect made by the botnet, we propose an approach using Virtual Honeynet data collection mechanisms to detect IRC and HTTP based botnet Command signatures. We have evaluated our approach using real world network traces.