P2P Botnet Research Articles

PeerShark: flow-clustering and conversation-generation for malicious peer-to-peer traffic identification

The distributed and decentralized nature of peer-to-peer (P2P) networks has offered a lucrative alternative to bot-masters to build botnets. P2P botnets are not prone to any single point of failure and have been proven to be highly resilient against takedown attempts. Moreover, smarter bots are stealthy in their communication patterns and elude the standard discovery techniques which look for anomalous network or communication behavior. In this paper, we present a methodology to detect P2P botnet traffic and differentiate it from benign P2P traffic in a network. Our approach neither assumes the availability of any ‘seed’ information of bots nor relies on deep packet inspection. It aims to detect the stealthy behavior of P2P botnets. That is, we aim to detect P2P botnets when they lie dormant (to evade detection by intrusion detection systems) or while they perform malicious activities (spamming, password stealing, etc.) in a manner which is not observable to a network administrator. Our approach PeerSharkPeerShark combines the benefits of flow-based and conversation-based approaches with a two-tier architecture, and addresses the limitations of these approaches. By extracting statistical features from the network traces of P2P applications and botnets, we build supervised machine learning models which can accurately differentiate between benign P2P applications and P2P botnets. PeerSharkPeerShark could also detect unknown P2P botnet traffic with high accuracy.

Resource monitoring for the detection of parasite P2P botnets

Detecting botnet behaviors in networks is a popular topic in the current research literature. The problem of detection of P2P botnets has been denounced as one of the most difficult ones, and this is even sounder when botnets use existing P2P networks infrastructure (parasite P2P botnets). The majority of the detection proposals available at present are based on monitoring network traffic to determine the potential existence of command-and-control communications (C&C) between the bots and the botmaster. As a different and novel approach, this paper introduces a detection scheme which is based on modeling the evolution of the number of peers sharing a resource in a P2P network over time. This allows to detect abnormal behaviors associated to parasite P2P botnet resources in this kind of environments. We perform extensive experiments on Mainline network, from which promising detection results are obtained while patterns of parasite botnets are tentatively discovered.

A P2P Botnet Detection Method Used On-line Monitoring and Off-line Detection

P2P botnet has become a significant threats in security network. In this paper, we propose a new method to detection the P2P botnet through the analysis of the P2P botnet host’s life cycle, use the method of off-line detection to find the suspected botnet hosts, and determine the P2P botnet host through online monitoring method. In this way, the efficiency and the accurate rate of P2P botnet detection have raised then only use one method, and reduce the harm of the P2P botnet.

PeerRush: Mining for unwanted P2P traffic

In this paper we present PeerRush, a novel system for the identification of unwanted P2P traffic. Unlike most previous work, PeerRush goes beyond P2P traffic detection, and can accurately categorize the detected P2P traffic and attribute it to specific P2P applications, including malicious applications such as P2P botnets. PeerRush achieves these results without the need of deep packet inspection, and can accurately identify applications that use encrypted P2P traffic.We implemented a prototype version of PeerRush and performed an extensive evaluation of the system over a variety of P2P traffic datasets. Our results show that we can detect all the considered types of P2P traffic with up to 99.5% true positives and 0.1% false positives. Furthermore, PeerRush can attribute the P2P traffic to a specific P2P application with a misclassification rate of 0.68% or less.

Propagation Modeling for P2P Botnet in Structured P2P Network

PDF HTML阅读 XML下载 导出引用 引用提醒 结构化对等网络中P2P 僵尸网络传播模型 DOI: 10.3724/SP.J.1001.2012.04186 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: 国家自然科学基金(61003248); 国家教育部博士点基金(20093108120016); 上海教委重点学科(J50103); 上海教委创新基金(09YZ05) Propagation Modeling for P2P Botnet in Structured P2P Network Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:依赖结构化对等网传播的P2P 僵尸是未来互联网面临的重要威胁.详细分析了两种典型的结构化P2P 协议Chord 和Kademlia 的工作原理,在此基础上,使用数学建模的方法建立了结构化P2P 僵尸网络的传播模型.该模型将Kademlia,Chord 协议与双因子免疫机制、主机在线率等因素相结合,较为全面地研究了两种典型的结构化P2P网络中僵尸的传播机理,并使用软件仿真的方法模拟了节点超过百万时,结构化P2P 网络中僵尸的传播行为,通过软件仿真得出的数据与理论数据进行对比,验证了模型的正确性.从实验结果可以看出:对于Kademlia 和Chord 两种结构化P2P 网络,僵尸传播无论是双因子免疫模型还是结合双因子与主机在线率的模型,理论模型与仿真结果都非常吻合,体现了模型的准确性,为僵尸的检测与防御提供了理论依据. Abstract:Depending on the structured peer-to-peer networks, the P2P botnets are the main threats of the Internet in the future. In this paper, a formal mathematical P2P botnet propagation model is built based on a deep analysis of two typical structured P2P protocols, Chord and Kademlia. This model, it integrates different factors, such as structured P2P protocols, two-factor immunizations, and host online rates to describe the structured P2P botnet propagation mechanisms comprehensively. Meanwhile, in order to evaluate the model effectiveness, simulate the P2P botnets propagation, the difference between the theoretical model and the simulation is used to verify the model efficiency. The experiments prove the correctness of the theoretical model also verify the different influences of structured P2P protocols, immunization mechanisms, and the host online rates on P2P botnet propagation. Moreover, through simulating P2P network with millions of nodes, it can be shown that the propagation model is correct and valid in large scale network, which provides a theoretical basis for botnet detection and prevention. 参考文献 相似文献 引证文献

Study of P2P Botnet

Today, centralized botnets are still widely used. In a centralized botnet, bots are connected to several servers (called CC however, it has a weak link - the C&C servers. Shutting down those servers would cause all the bots lose contact with their botmaster. In addition, defenders can easily monitor the botnet by creating a decoy to join a specified C&C channel. Today several P2P botnets have emerged Just like P2P networks, which are resilient to dynamic churn (i.e., peers join and leave the system at high rates), P2P botnet communication won't be disrupted when losing a number of bots. In a P2P botnet, there is no central server, and bots are connected to each other and act as both C&C server and client. P2P botnets have shown advantages over traditional centralized botnets. As the next generation of botnets, they are more robust and difficult for security community to defend. Researchers have started to pay attention to P2P botnets. However, in order to effectively fight against this new form of botnets, enumerating every individual P2P botnet we have seen in the wild is not enough. Instead, we need to study P2P botnets in a systematic way.

A REVIEW OF PEER-TO-PEER BOTNET DETECTION TECHNIQUES

In recent years, Peer-to-Peer technology has an ext ensive use. Botnets have exploited this technology efficiently and introduced the P2P botnet, which us es P2P network for remote control of its bots and become one of the most significant threats to compu ter networks. They are used to make DDOS attacks, generate spam, click fraud and steal sensitive info rmation. Compared with traditional botnets, P2P bot nets are harder to be defended and hijacked. In this stu dy we discuss various P2P botnet detection approaches and evaluate their effectiveness. We identify the advantages and shortcomings of each of the discussed techniques. This can guide the researchers to a bet ter understanding of P2P botnets and easier for the m developing more sufficient detection techniques. Ou r evaluation shows that each technique has its own advantages and limitations. Two or more detection t echniques might be used together, in order to have a robust P2P botent detection.

Modeling Peer-to-Peer Botnet on Scale-Free Network

Peer-to-peer (P2P) botnets have emerged as one of the serious threats to Internet security. To prevent effectively P2P botnet, in this paper, a mathematical model which combines the scale-free trait of Internet with the formation of P2P botnet is presented. Explicit mathematical analysis demonstrates that the model has a globally stable endemic equilibrium when infection rate is greater than a critical value. Meanwhile, we find that, in scale-free network, the critical value is very little. Hence, it is unrealistic to completely dispel the P2P botnet. Numerical simulations show that one can take effective countermeasures to reduce the scale of P2P botnet or delay its outbreak. Our findings can provide meaningful instruction to network security management.

Building a Scalable System for Stealthy P2P-Botnet Detection

Peer-to-peer (P2P) botnets have recently been adopted by botmasters for their resiliency against take-down efforts. Besides being harder to take down, modern botnets tend to be stealthier in the way they perform malicious activities, making current detection approaches ineffective. In addition, the rapidly growing volume of network traffic calls for high scalability of detection systems. In this paper, we propose a novel scalable botnet detection system capable of detecting stealthy P2P botnets. Our system first identifies all hosts that are likely engaged in P2P communications. It then derives statistical fingerprints to profile P2P traffic and further distinguish between P2P botnet traffic and legitimate P2P traffic. The parallelized computation with bounded complexity makes scalability a built-in feature of our system. Extensive evaluation has demonstrated both high detection accuracy and great scalability of the proposed system.

Towards accurate node-based detection of P2P botnets.

Botnets are a serious security threat to the current Internet infrastructure. In this paper, we propose a novel direction for P2P botnet detection called node-based detection. This approach focuses on the network characteristics of individual nodes. Based on our model, we examine node's flows and extract the useful features over a given time period. We have tested our approach on real-life data sets and achieved detection rates of 99-100% and low false positives rates of 0–2%. Comparison with other similar approaches on the same data sets shows that our approach outperforms the existing approaches.

Analysis and Improvement Design on P2P Botnets Detection Framework

Developing the P2P botnets detection framework is crucial when we trying to fight against P2P botnets. Poor detection method can lead to a failure of P2P botnets detection. Thus, it needs to be accurately functioned well. This paper reviews and evaluates various current frameworks of P2P botnets detection and analyzing the existing gaps to make improvement of P2P botnets detection framework. Based on a review that conducted manually, we report our findings and analysis has been done on different frameworks concern on P2P botnets detection. Consequently, the gap and motivations found from this reviews are discussed. Then, the P2P botnets detection framework architecture has been proposed with the new improvement been reinforced by hybrid detection technique, hybrid analyzer and in-depth hybrid analysis. Future directions of this review are to develop the P2P botnets detection system that has capability in high detection accuracy and efficiency.

Botnet Detection Based on Correlation of Malicious Behaviors

Botnet has become the most serious security threats on the current Internet infrastructure. Botnet is a group of compromised computers (Bots) which are remotely controlled by its originator (BotMaster) under a common Command and Control (C&C) infrastructure. Botnets can not only be implemented by using existing well known bot tools, but can also be constructed from scratch and developed in own way, which makes the botnet detection a challenging problem. Because the P2P (peer to peer) botnet is a distributed malicious software network, it is more difficult to detect this bot. In this paper, we proposed a new general Botnet detection correlation algorithm, which is based on the correlation of host behaviors and classification method for network behaviors. The experimental results show the proposed approach not only can successfully detect known botnet with a high detection rate but it can also detect some unknown malware.

Modeling and evaluating of typical advanced peer-to-peer botnet

In this paper, we present a general model for an advanced peer-to-peer (P2P) botnet, in which the performance of the botnet can be systematically studied. From the model, we can derive five performance metrics to describe the robustness, security and efficiency of the botnet. Additionally, we analyze the relationship between the performance metrics and the model feature metrics of the botnet, and it is helpful to study the botnet under different model feature metrics. Furthermore, the proposed model can be easily applied to other types of botnets. Finally, taking the robustness and security into consideration, an optimization scheme for designing an optimal P2P botnet is proposed.

An Efficient Machine Learning Based Classification Scheme for Detecting Distributed Command & Control Traffic of P2P Botnets

Biggest internet security threat is the rise of Botnets having modular and flexible structures. The combined power of thousands of remotely controlled computers increases the speed and severity of attacks. In this paper, we provide a comparative analysis of machine-learning based classification of botnet command & control(C&C) traffic for proactive detection of Peer-to- Peer (P2P) botnets. We combine some of selected botnet C&C traffic flow features with that of carefully selected botnet behavioral characteristic features for better classification using machine learning algorithms. Our simulation results show that our method is very effective having very good test accuracy and very little training time. We compare the performances of Decision Tree (C4.5), Bayesian Network and Linear Support Vector Machines using performance metrics like accuracy, sensitivity, positive predictive value(PPV) and F-Measure. We also provide a comparative analysis of our predictive models using AUC (area under ROC curve). Finally, we propose a rule induction algorithm from original C4.5 algorithm of Quinlan. Our proposed algorithm produces better accuracy than the original decision tree classifier.

New P2P botnet with high survivability based on Kademlia protocol

At present there are many kinds of technologies which can track,detect and counter botnet effectively,which are serious threats to botnet.In order to improve the survivability of botnets,with the analysis on the existing anti-botnet technology,the paper proposd a new P2P-botnet based on Kademlia protocol from an attacker's prospective.A communication encryption and node authentication mechanism was designed.The theoretical analysis shows that the mechanism can effectively address improper command attack and sybil attack.Eventually,the experimental results verify that this botnet has high survivability.

Detecting P2P bots by mining the regional periodicity

Peer-to-peer (P2P) botnets outperform the traditional Internet relay chat (IRC) botnets in evading detection and they have become a prevailing type of threat to the Internet nowadays. Current methods for detecting P2P botnets, such as similarity analysis of network behavior and machine-learning based classification, cannot handle the challenges brought about by different network scenarios and botnet variants. We noticed that one important but neglected characteristic of P2P bots is that they periodically send requests to update their peer lists or receive commands from botmasters in the command-and-control (C&C) phase. In this paper, we propose a novel detection model named detection by mining regional periodicity (DMRP), including capturing the event time series, mining the hidden periodicity of host behaviors, and evaluating the mined periodic patterns to identify P2P bot traffic. As our detection model is built based on the basic properties of P2P protocols, it is difficult for P2P bots to avoid being detected as long as P2P protocols are employed in their C&C. For hidden periodicity mining, we introduce the so-called regional periodic pattern mining in a time series and present our algorithms to solve the mining problem. The experimental evaluation on public datasets demonstrates that the algorithms are promising for efficient P2P bot detection in the C&C phase.

Detecting Members of P2P Botnets Using Probabilistic Dye-Pumping Algorithm

봇넷은 악성 코드에 의해 감염된 봇 호스트들로 이루어진 네트워크를 의미한다. 보편적으로 쓰이고 있는 중앙집중형(Centralized) 봇넷의 경우 C&C(Command and Control) 서버의 위치 탐지에 의해 봇넷 전체의 구조파악이 용이한 반면, P2P(peer-to-peer) 봇넷은 중앙 서버가 없고 여러 가지 회피 기술로 인해 봇넷의 구조를 파악하기 어렵다. 본 논문에서는 라우터를 기준으로 내부와 외부 네트워크를 구분하고, 내부와 외부 네트워크의 송수신 패킷의 경로와 감염 확률을 통해 P2P 봇넷을 탐지하는 방법에 대해 연구하였다. 본 연구에서는 기존의 P2P 봇넷 탐지 방법인 염료-펌핑(Dye-Pumping) 알고리즘의 한계를 개선하였으며, 이는 단위 네트워크내의 P2P 봇 호스트들을 탐지하고 이들의 활동을 사전에 방지하여 P2P 봇넷이 외부로 확산되는 것을 막을 수 있는 기술로써 사용될 수 있다.

Effective immune measures on P2P botnets

For deeply analyzing the factors that affect the prevalence of P2P botnets,the formation of a Peer-to-Peer(P2P) botnet was portrayed from dynamic perspective.Firstly,the differential equation model was formulated according to the formation of P2P botnets,which considered the effect of immunization on computer malware propagation.Furthermore,effective immune ratio of eliminating P2P botnets was calculated by analyzing steady condition of equilibrium in the model.Finally,the effective immune region was obtained and verified by deterministic simulation and stochastic simulation,respectively.The results show that the outbreak of P2P botnets can be effectively prevented by reasonable immune measures.

Research on P2P Botnet Modeling and Traffic Characteristic

Research on P2P Botnet Modeling and Traffic Characteristic

A novel method of mining network flow to detect P2P botnets

Botnets are a serious threat to cyber-security. As a consequence, botnet detection has become an important research topic in network protection and cyber-crime prevention. P2P botnets are one of the most malicious zombie networks, as their architecture imitates P2P software. Characteristics of P2P botnets include (1) the use of multiple controllers to avoid single-point failure; (2) the use of encryption to evade misuse detection technologies; and (3) the capacity to evade anomaly detection, usually by initiating numerous sessions without consuming substantial bandwidth. To overcome these difficulties, we propose a novel data mining method. First, we identify the differences between P2P botnet behavior and normal network behavior. Then, we use these differences to tune the data-mining parameters to cluster and distinguish normal Internet behavior from that lurking P2P botnets. This method can identify a P2P botnet without breaking the encryption. Furthermore, the detection system can be deployed without altering the existing network architecture, and it can detect the existence of botnets in a complex traffic mix before they attack. The experimental results reveal that the method is effective in recognizing the existence of botnets. Accordingly, the results of this study will be of value to information security academics and practitioners.