A Hierarchical Hybrid Structure for Botnet Control and Command Zhiqi Zhang , Baochen Lu , Peng Liao , Chaoge Liu , Xiang Cui - Computer Science and Automation Engineering (CSAE), 2011 IEEE International Conference

Speaker : Yi-Ting TsaiDate : 102.11.7

Outline Centralized Botnet

P2P Botnet

Hyprid P2P Botnet

Hierechical hybrid Botnet

Robustness Simulation

Defense against the proposed Botnet

Conclusion

Botnet

Botmaster

C&C Server

Bot

1/14

Centralized Botnet

ｘCharacteristics: relay on C&C ServersｘWeakness: single-failureｘExample: AgoBot , SDBot , SpyBot

2/14

P2P Botnet

ｘKademlia-based protocol

ｘrandom probing protocol

ｘBootstrap failure

ｘExtensive abnormal traffic

3/14

ｘExample : Slapper botnets

ｘExample : Sinit botnets

----

----

----

----

ｘSybil attack

ｘSybil attack

----

Hyprid P2P Botnet

ｘservent bots : static global IPｘslave bots : dynamic private

IP

Servent bots IP

Peer list

------------------

Slave bots (client)

Servent bots(server+client)

----

----

------

--

----

----

ｘWeakness: ｘSybil attack ｘcommunication between

clients4/14

Hierechical hybrid Botnet

1 . Resolve --ｘSybil attack ｘcommunication between

clients2 . Difficult to be shut down3 . Keep botnet under control

5/14

Slave bots (client)

Servent bots(server+client)

No Sybil attack

Advanced bootstrap process

No detect

No hijacking

0failur

ePoll succeed

1failur

e

Poll fail

Poll succeed

2 failur

e

Poll fail

Poll succeed

N-1 failur

e

Nfailur

eDelet

e

Poll fail

Poll fail

0 failure1 failure2 failureN-1 failureN failure

6/14

0 failure

Peer list0 failure

1 failure

N failure. . . .

< IP , port >

7/14

No Sybil attack

Advanced bootstrap process

No detect

No hijacking

Peer list0 failure

1 failure

N failure

. . . .

< IP , port >

ᘞ Random service port

||

Perfect !

+ᘞ Data encryption

8/14

No Sybil attack

Advanced bootstrap process

No detect

No hijacking

ｘCommunication Encryption

ｘCommand Authentication

ｘOne-time padding

ｘPrivate key signature

Private keyPublic key

Public key

Private key

Public key9/14

Private key

No Sybil attack

Advanced bootstrap process

No detect

No hijacking

Robustness Simulation Definition : the probability that a botnet remains connected together after a fraction of bots are removed.

10/14G = ( V , E ) V : bots

Simulation settingsServent bots : 25%Maximum size of botnets : 10000Peer list () : 20

igraph library

Network Workbench

Tool 11/14

Peer list size and Robustness

Servent bots : 25%Maximum size of botnets : 10000Bots to removed ( P ) = 95%

12/14

Defense against the proposed Botnet

A. Host-based Detection• Signature-based malware detection• Behavior-based detection

13/14

B. Honeypot-based Monitoring

Conclusion ｘHierarchical hybrid p2p botnet

ｘan advanced peer listｘ It can defend against Sybil attacks

ｘWeakness : ｘvery high complexityｘvery high latency

14/14