Types Of Botnets Research Articles

Ensemble classification to predict botnet and its impact on IoT networks

The IoT (Internet of Things) has been rapidly growing to make a stronger influence on huge industrial systems. Since cybercriminals have made IoT a target for harmful operations such as botnets, an attack on the end nodes is now a possibility. Protecting IoT infrastructure with a typical intrusion detection system is difficult because of its vastness, variety, and minimal resource availability. Harmful "bot sources” (servers) control a botnet, which is made up of hacked devices that are employed for several illicit purposes like sending spam, initiating DoS attacks, and stealing personal data. Because bot sources generate network traffic while conversing with their bots, Intrusion Detection Systems could benefit from analyzing traffic on the network to detect Botnet traffic. DDoS attacks and spam distribution are common uses for botnets.As machine learning (ML) approaches are employed in various niches of security, it appears practical and workable to use ML to detect botnets. ML has been used in various researches to detect botnets. However, the results are either unreliable or limited to certain types of botnets or devices. Current approaches attempt to solve these issues by presenting models that are trained on botnet features, but the large dimensionality of feature values and the reliance on botnet features alone are serious drawbacks. In order to address these constraints, a novel botnet and its impact detection by a typical ensemble classification approach has been proposed by the current work. The framework uses the correlated traffic-flow and botnet features to train the classifier, which is titled as "Ensemble Classification to Predict Botnet and its Impact (EC-PBI) on IoT Networks". The experimental study is a cross validation approach that is performed using a multi-label, fourfold strategy. Performance analysis of the proposed approach was done by comparing it with contemporary models. Results prove its efficiency in detecting botnet and its impact.

An intelligent multi-layer framework with SHAP integration for botnet detection and classification

In increasingly interconnected digital world, the threat of cyber-attacks and data breaches are a pervasive and growing concern. The Botnets are the most dangerous threats that launch a wide range of cyberattacks such as distributed denial of service (DDoS) attacks, sending spam emails, spreading malware, and stealing sensitive information. The identification and categorization of botnets has become a highly complex and critical process due to the massive amount of network traffic generated every second. This paper presents a multilayer botnet detection and classification framework based on explainable machine learning algorithms. The proposed approach comprises of three distinct layers: Feature Selection Layer, Botnet Detection Layer and Botnet Classification Layer. The Feature Selection Layer reduces the dataset into six essential features, that enhance the accuracy and efficiency of the framework. The botnet detection layer detects botnet activity by filtering the reduced dataset into normal packets and botnet packets. The filtered botnet packets further examined by botnet classification layer to classify the botnet packets into different types of botnets. Moreover, SHAP (SHapley Additive exPlanations) technique is utilized to provide transparency to the model's decision-making process. To evaluate the effectiveness of the proposed model, NCC-2 and CTU-13 datasets are examined. 10-fold cross-validation technique is applied to validate the experimental findings. The average accuracy achieved by proposed approach in botnet detection stands impressively at 99.98%, while the average accuracy achieved in classifying botnet families is 99.30%, exhibiting an exceptional level of performance. The comparative analysis is performed which demonstrates its superiority over existing methods in terms of accuracy, precision, recall, F1-Score.

Autonomous machine learning for early bot detection in the internet of things

The high costs incurred due to attacks and the increasing number of different devices in the Internet of Things (IoT) highlight the necessity of the early detection of botnets (i.e., a network of infected devices) to gain an advantage against attacks. However, early botnet detection is challenging because of continuous malware mutations, the adoption of sophisticated obfuscation techniques, and the massive volume of data. The literature addresses botnet detection by modeling the behavior of malware spread, the classification of malicious traffic, and the analysis of traffic anomalies. This article details ANTE, a system for ANTicipating botnEt signals based on machine learning algorithms. The system adapts itself to different scenarios and detects different types of botnets. It autonomously selects the most appropriate Machine Learning (ML) pipeline for each botnet and improves the classification before an attack effectively begins. The system evaluation follows trace-driven experiments and compares ANTE results to other relevant results from the literature over four representative datasets: ISOT HTTP Botnet, CTU-13, CICDDoS2019, and BoT-IoT. Results show an average detection accuracy of 99.06% and an average bot detection precision of 100%.

Combining Deep Learning Models for Enhancing the Detection of Botnet Attacks in Multiple Sensors Internet of Things Networks

Distributed-Denial-of-Service impacts are undeniably significant, and because of the development of IoT devices, they are expected to continue to rise in the future. Even though many solutions have been developed to identify and prevent this assault, which is mainly targeted at IoT devices, the danger continues to exist and is now larger than ever. It is common practice to launch denial of service attacks in order to prevent legitimate requests from being completed. This is accomplished by swamping the targeted machines or resources with false requests in an attempt to overpower systems and prevent many or all legitimate requests from being completed. There have been many efforts to use machine learning to tackle puzzle-like middle-box problems and other Artificial Intelligence (AI) problems in the last few years. The modern botnets are so sophisticated that they may evolve daily, as in the case of the Mirai botnet, for example. This research presents a deep learning method based on a real-world dataset gathered by infecting nine Internet of Things devices with two of the most destructive DDoS botnets, Mirai and Bashlite, and then analyzing the results. This paper proposes the BiLSTM-CNN model that combines Bidirectional Long-Short Term Memory Recurrent Neural Network and Convolutional Neural Network (CNN). This model employs CNN for data processing and feature optimization, and the BiLSTM is used for classification. This model is evaluated by comparing its results with three standard deep learning models of CNN, Recurrent Neural Network (RNN), and long-Short Term Memory Recurrent Neural Network (LSTM–RNN). There is a huge need for more realistic datasets to fully test such models' capabilities, and where N-BaIoT comes, it also includes multi-device IoT data. The N-BaIoT dataset contains DDoS attacks with the two of the most used types of botnets: Bashlite and Mirai. The 10-fold cross-validation technique tests the four models. The obtained results show that the BiLSTM-CNN outperforms all other individual classifiers in every aspect in which it achieves an accuracy of 89.79% and an error rate of 0.1546 with a very high precision of 93.92% with an f1-score and recall of 85.73% and 89.11%, respectively. The RNN achieves the highest accuracy among the three individual models, with an accuracy of 89.77%, followed by LSTM, which achieves the second-highest accuracy of 89.71%. CNN, on the other hand, achieves the lowest accuracy among all classifiers of 89.50%.

A Hybrid Association Rule-Based Method to Detect and Classify Botnets

Nowadays, botnet has become a threat in the area of cybersecurity, and, worse still, it is difficult to be detected in complex network environments. Thus, traffic analysis is adopted to detect the botnet since this kind of method is practical and effective; however, the false rate is very high. The reason is that normal traffic and botnet traffic are quite close to the border, making it so difficult to be recognized. In this paper, we propose an algorithm based on a hybrid association rule to detect and classify the botnets, which can calculate botnets’ boundary traffic features and receive effects in the identification between normal and botnet traffic ideally. First, after collecting the data of different botnets in a laboratory, we analyze botnets traffic features by processing a data mining on it. The suspicious botnet traffic is filtered through DNS protocol, black and white list, and real-time feature filtering methods. Second, we analyze the correlation between domain names and IP addresses. Combining with the advantages of the existing time-based detection methods, we do a global correlation analysis on the characteristics of botnets, to judge whether the detection objects can be botnets according to these indicators. Then, we calculate these parameters, including the support, trust, and membership functions for association rules, to determine which type of botnet it belongs to. Finally, we process the test by using the public dataset and it turns out that the accuracy of our algorithm is higher.

IoTBoT-IDS: A novel statistical learning-enabled botnet detection framework for protecting networks of smart cities

The rapid proliferation of the Internet of Things (IoT) systems, has enabled transforming urban areas into smart cities. Smart cities’ paradigm has resulted in improved quality of life and better services to citizens, like smart healthcare, smart parking, smart transport, smart buildings, smart homes, and so on. One of the major challenges of IoT devices is the limited capacity of their battery because the devices consume a large amount of energy once they communicate with each other. Furthermore, the IoT-based smart systems would contain sensitive data about network systems, introducing serious privacy and security issues. IoT-based smart systems are highly exposed to botnet attacks. Examples of such attacks are Mirai and BASHLITE malware launched from compromised surveillance devices, which are common in smart cities, resulting in paralysis of Internet-based services through distributed denial of service (DDoS) attacks. Such DDoS attacks on IoT devices and their networks further threaten the emerging concept of sustainable smart cities. To discover such cyberattacks, this paper proposes a novel statistical learning-based botnet detection framework, called IoTBoT-IDS, which protects IoT-based smart networks against botnet attacks. IoTBoT-IDS captures the normal behavior of IoT networks by applying statistical learning-based techniques, using Beta Mixture Model (BMM) and a Correntropy model. Any deviation from the normal behavior is detected as an anomalous event. To evaluate IoTBoT-IDS, three benchmark datasets generated from realistic IoT networks were used. The evaluation results showed that IoTBoT-IDS effectively identifies various types of botnets with an average detection accuracy of 99.2%, which is higher by about 2–5% compared with compelling intrusion detection methods, namely AdaBoost ensemble learning, fuzzy c-means, and deep feed forward neural networks.

Design and Implementation of Automated Steganography Image-Detection System for the KakaoTalk Instant Messenger

As the popularity of social network service (SNS) messengers (such as Telegram, WeChat or KakaoTalk) grows rapidly, cyberattackers and cybercriminals start targeting them, and from various media, we can see numerous cyber incidents that have occurred in the SNS messenger platforms. Especially, according to existing studies, a novel type of botnet, which is the so-called steganography-based botnet (stego-botnet), can be constructed and implemented in SNS chat messengers. In the stego-botnet, by using various steganography techniques, every botnet communication and control (C&C) messages are secretly embedded into multimedia files (such as image or video files) frequently shared in the SNS messenger. As a result, the stego-botnet can hide its malicious messages between a bot master and bots much better than existing botnets by avoiding traditional botnet-detection methods without steganography-detection functions. Meanwhile, existing studies have focused on devising and improving steganography-detection algorithms but no studies conducted automated steganography image-detection system although there are a large amount of SNS chatrooms on the Internet and thus may exist many potential steganography images on those chatrooms which need to be inspected for security. Consequently, in this paper, we propose an automated system that detects steganography image files by collecting and inspecting all image files shared in an SNS chatroom based on open image steganography tools. In addition, we implement our proposed system based on two open steganography tools (Stegano and Cryptosteganography) in the KakaoTalk SNS messenger and show our experimental results that validate our proposed automated detection system work successfully according to our design purposes.

Construction and Performance Analysis of Image Steganography-Based Botnet in KakaoTalk Openchat

Once a botnet is constructed over the network, a bot master and bots start communicating by periodically exchanging messages, which is known as botnet C&C communication, in order to send botnet commands to bots, collect critical information stored in bots, upgrade software functions of malwares installed in bots, and so on. For this reason, most existing botnet detection techniques focus on monitoring and capturing suspicious communications between the bot master and bots. Meanwhile, botnets continue to evolve to hide their C&C communication. Recently, a novel type of botnet using image steganography techniques and SNS (Social Network Service) platforms, which is known as image steganography-based botnet or stegobotnet, has emerged to make its C&C communications undetectable by existing botnet detection systems. In stegobotnets, image files used in SNSs carry messages (between the bot master and bots) which are hidden in them by using image steganography techniques. In this paper, we first investigate whether major SNS platforms such as KakaoTalk, Facebook, and Twitter can be suitable for constructing image steganography-based botnets. Next, we construct a part of stegobotnet based on KakaoTalk, and conduct extensive experiments including digital forensic analysis (1) to validate stegobotnet C&C communication can be successful in KakaoTalk and (2) to examine its performance in terms of C&C communication reliability.

An Adaptive Multi-Layer Botnet Detection Technique Using Machine Learning Classifiers

In recent years, the botnets have been the most common threats to network security since it exploits multiple malicious codes like a worm, Trojans, Rootkit, etc. The botnets have been used to carry phishing links, to perform attacks and provide malicious services on the internet. It is challenging to identify Peer-to-peer (P2P) botnets as compared to Internet Relay Chat (IRC), Hypertext Transfer Protocol (HTTP) and other types of botnets because P2P traffic has typical features of the centralization and distribution. To resolve the issues of P2P botnet identification, we propose an effective multi-layer traffic classification method by applying machine learning classifiers on features of network traffic. Our work presents a framework based on decision trees which effectively detects P2P botnets. A decision tree algorithm is applied for feature selection to extract the most relevant features and ignore the irrelevant features. At the first layer, we filter non-P2P packets to reduce the amount of network traffic through well-known ports, Domain Name System (DNS). query, and flow counting. The second layer further characterized the captured network traffic into non-P2P and P2P. At the third layer of our model, we reduced the features which may marginally affect the classification. At the final layer, we successfully detected P2P botnets using decision tree Classifier by extracting network communication features. Furthermore, our experimental evaluations show the significance of the proposed method in P2P botnets detection and demonstrate an average accuracy of 98.7%.

Mobile botnets meet social networks: design and analysis of a new type of botnet

The ubiquitous nature of smartphone services and the popularity of online social networking can be a lethal combination that spreads malware and computer viruses in a quick and efficient manner to a large number of Internet users. In this article, we propose a new cellular botnet named SoCellBot that exploits online social networks (OSNs) to recruit bots and uses OSN messaging systems as communication channels between bots. Our proposed botnet is the first that uses the OSN platform as a means to recruit and control mobile cellular bots. The structure and characteristics of OSNs make this botnet harder to detect, more resilient to bot failures and more cost-effective to cellular bots. We present a comprehensive study of this new type of botnet in this article. We first analyze the characteristics of the botnet via simulations. We then present an analytical model to estimate the number of infected users (smart phones) over time. We also provide a real-life implementation of the botnet on a small-scale social network as proof of concept. Finally, we study and recommend effective mechanisms to detect recruitment malware spread by such a botnet in its early stages of propagation. The objective of this work is to raise awareness of new mobile botnets that exploit OSNs to recruit and control bots so that preventive measures can be implemented to deter this kind of attack in the future.

Botnet Detection via mining of network traffic flow

During the past decade, botnet has emerged as a very serious threat to cyber security by proving it’s capability of compromising billions of computers and making them does the illegal work. There are a number of existing ways by which botnet can be detected. A comprehensive overview of the existing techniques is also stated in this paper. Due to the involvement of huge amount of data, detection of botnet using machine learning algorithms is in huge trend. In this paper, we have used machine learning to train classifiers by a specific network flow dataset. Thereafter, the trained classifiers were applied on the collected data in order to evaluate the results. Analysis of network flow data is usedas a method of detection because it doesn’t depend upon the packet content hence giving immunity towards the latest form of encryption and obfuscation used by attackers in order to hide their bots. Results are clearly showing that the proposed method is capable of differentiating the normal traffic and the bot traffic with a high accuracy and low false positive rate. In addition to this, almost every type of botnet can be detected using the proposed model.

Analysis and Detection of Bot performing Keylogging Activities.

The focus on computer security has increased due to the ubiquitous use of Internet. Botnets are one of the biggest cyber threats. Botnet is a malware controlled by a Botmaster using Command and Control (C&C). Botnet is expanded with infecting fresh computers through social networking sites like facebook, twitter, etc. ZeuS is famous type of botnet for financial gain. It targets bank websites for stealing user’s credentials like password, credit card information,etc. In this paper, an application framework is designed for analysis and detection of ZeuS bot residing on host victim’s machine. The detection phase is based on analysis of bot’s infection stategy means in what way it affects the victims’s pc. All the related files are wiped out from the system in removal phase. The communication between command and control server and the victim machine is analysed in a virtual environment.

An efficient method to detect periodic behavior in botnet traffic by analyzing control plane traffic

Botnets are large networks of bots (compromised machines) that are under the control of a small number of bot masters. They pose a significant threat to Internet’s communications and applications. A botnet relies on command and control (C2) communications channels traffic between its members for its attack execution. C2 traffic occurs prior to any attack; hence, the detection of botnet’s C2 traffic enables the detection of members of the botnet before any real harm happens. We analyze C2 traffic and find that it exhibits a periodic behavior. This is due to the pre-programmed behavior of bots that check for updates to download them every T seconds. We exploit this periodic behavior to detect C2 traffic. The detection involves evaluating the periodogram of the monitored traffic. Then applying Walker’s large sample test to the periodogram’s maximum ordinate in order to determine if it is due to a periodic component or not. If the periodogram of the monitored traffic contains a periodic component, then it is highly likely that it is due to a bot’s C2 traffic. The test looks only at aggregate control plane traffic behavior, which makes it more scalable than techniques that involve deep packet inspection (DPI) or tracking the communication flows of different hosts. We apply the test to two types of botnet, tinyP2P and IRC that are generated by SLINGbot. We verify the periodic behavior of their C2 traffic and compare it to the results we get on real traffic that is obtained from a secured enterprise network. We further study the characteristics of the test in the presence of injected HTTP background traffic and the effect of the duty cycle on the periodic behavior.

Modeling and evaluating of typical advanced peer-to-peer botnet

In this paper, we present a general model for an advanced peer-to-peer (P2P) botnet, in which the performance of the botnet can be systematically studied. From the model, we can derive five performance metrics to describe the robustness, security and efficiency of the botnet. Additionally, we analyze the relationship between the performance metrics and the model feature metrics of the botnet, and it is helpful to study the botnet under different model feature metrics. Furthermore, the proposed model can be easily applied to other types of botnets. Finally, taking the robustness and security into consideration, an optimization scheme for designing an optimal P2P botnet is proposed.

Detecting A Botnet By Reverse Engineering

Abstract— Botnet malware is a malicious program. Botnet that infects computers, called bots, will be controlled by a botmaster to do various things such as: spamming, phishing, keylogging Distributed Denial of Service (DDoS) and other activities that are generally profitable to the owner of the bot (botmaster) or those who use botnet services. The problem is that many computers have been controlled by botnets without the knowledge of the computer owner. There are many ways to examine botnets, for example by studying the traffic from the botnet network, studying how botnets communicate to each, studying how each robot receives orders to do something, and so forth. Of the many methods, the most frequently and commonly used is the reverse engineering, where researchers study how a botnet works by botnet debugging.In this study the author tries to understand or research botnets by taking a type of botnet, namely Agobot, using reverse engineering. One of the result of the research is that malware program files in general and in particular botnet has a technique to obscure the way that research using reverse engineering.Another result also shows that the botnet Agobot runs on computers by using the Windows service, and by changing the Windows registry so that every time the computer starts, Agobot always actively works in the computer memory.Keywords— Malware, Bot, Botnet, Botmaster, Agobot, Spam, Distributed Denial of Services, Identity Theft, Computer Security, Reverse Engineering, Debug, Windows Service, the Registry.

Tsunami: A parasitic, indestructible botnet on Kad

While current botnets rely on a central server or bootstrap nodes for their operations, in this paper we identify and investigate a new type of botnet, called Tsunami, in which no such bottleneck nodes exist. In particular, we study how a Tsunami botnet can build a parasitic relationship with a widely deployed P2P system, Kad, to successfully issue commands to its bots, launch various attacks, including distributed denial of service (DDoS) and spam, at ease, as well as receive responses from the bots. Our evaluation shows that in a Kad network with four million nodes, even with only 6 % nodes being Tsunami bots, Tsunami can reach 75 % of its bots in less than 4 min and receive responses from 99 % of bots. We further propose how we may defend against Tsunami and evaluate the defense solution.

Modeling and analyzing of botnet interactions

The dynamics of interacting botnets and the effects of the strategies selected by interacting botnet owners on the spread of botnets remain unclear. As a result, in this paper, we present a botnet interaction model, obtained by coupling a fast evolutionary game dynamics to a slow population dynamics model, in which two botnet types are considered. We analyze the fast evolutionary game model and obtain two stable equilibria. Additionally, we substitute them into the complete model and get two reduced models. Such models allow us to study the effects of strategies selected by botnet owners. Analysis of the models shows that when all owners adopt the cooperative strategy both types of botnets can survive with much lower contact rates. However, while they choose the competitive strategy one type of botnet will become extinct and the other will persist with a lower infection rate. The equilibrium conditions of the evolutionary game model, which can guide us in designing effective counter-botnet methods, are also obtained.