Behavioral analysis of botnets for threat intelligence

Çağlayan, Alper; Toothaker, Mike; Drapeau, Dan; Burke, Dustin; Eaton, Gerry

doi:10.1007/s10257-011-0171-7

Cited by 17 publications

(10 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Once a network has been selected as a target, it is assessed for vulnerability and the mission becomes oriented toward gaining access (Caglayan et al 2012;Brewer 2014). Vulnerability assessment may require less intensive efforts or more intensive efforts, depending on what is already known about the target.…”

Section: Assessing System Vulnerabilitymentioning

confidence: 99%

“…The sustainment of S-APT operations is to some extent dependent on the maintenance of infrastructure external to the target network. Prior to launching an attack, "command and control" servers-which will be used during the attack to focus efforts, channel traffic and operate malware-must be established and available (Tankard 2011 andCaglayan et al 2012). Command and control servers are typically computers that were compromised during previous missions (Bradbury 2010;Raiu 2012).…”

Section: Assuring Sustainabilitymentioning

confidence: 99%

See 1 more Smart Citation

Strategically-motivated advanced persistent threat: Definition, process, tactics and a disinformation model of counterattack

Ahmad

Webb²,

Desouza

et al. 2019

Computers & Security

View full text Add to dashboard Cite

Advanced persistent threat (APT) is widely acknowledged to be the most sophisticated and potent class of security threat. APT refers to knowledgeable human attackers that are organized, highly sophisticated and motivated to achieve their objectives against a targeted organization(s) over a prolonged period. Strategically-motivated APTs or S-APTs are distinct in that they draw their objectives from the broader strategic agenda of third parties such as criminal syndicates, nation-states, and rival corporations. In this paper we review the use of the term "advanced persistent threat," and present a formal definition. We then draw on military science, the science of organized conflict, for a theoretical basis to develop a rigorous and holistic model of the stages of an APT operation which we subsequently use to explain how S-APTs execute their strategically motivated operations using tactics, techniques and procedures. Finally, we present a general disinformation model, derived from situation awareness theory, and explain how disinformation can be used to attack the situation awareness and decision making of not only S-APT operators, but also the entities that back them.

show abstract

Section: Assessing System Vulnerabilitymentioning

confidence: 99%

Section: Assuring Sustainabilitymentioning

confidence: 99%

Strategically-motivated advanced persistent threat: Definition, process, tactics and a disinformation model of counterattack

Ahmad

Webb²,

Desouza

et al. 2019

Computers & Security

View full text Add to dashboard Cite

show abstract

“…One way by which this is achieved is by comparing certain characteristics of network traffic with a database of attributes (signatures) that have already been associated with specific botnet behaviours, such as those proposed by Zand et al [73], Bilge et al [74] and Bhatia et al [75]. Furthermore, as seen in the literature, another technique seeks to analyse network traffic for traffic/packets that exhibit behaviours that deviate from the normal, observable network behaviour (an anomaly), such as those proposed by Wang et al [76], Boukhtouta et al [77], Zhao et al [78] and Caglayan et al [79]. Anomalous behaviours could also be analysed in relation to hypertext transfer protocol (HTTP) traffic, such as noted by Jia et al [80], Mathew et al [81], Choi et al [82] and Eslahi et al [83]; domain name service (DNS) query patterns and properties, such as by Seo et al [84] and Futai et al [85]; and transmission control protocol (TCP) requests, such as that looked into by Abdullah et al [86].…”

Section: Analysis-basedmentioning

confidence: 99%

A Botnets Circumspection: The Current Threat Landscape, and What We Know So Far

et al. 2019

View full text Add to dashboard Cite

Botnets have carved a niche in contemporary networking and cybersecurity due to the impact of their operations. The botnet threat continues to evolve and adapt to countermeasures as the security landscape continues to shift. As research efforts attempt to seek a deeper and robust understanding of the nature of the threat for more effective solutions, it becomes necessary to again traverse the threat landscape, and consolidate what is known so far about botnets, that future research directions could be more easily visualised. This research uses the general exploratory approach of the qualitative methodology to survey the current botnet threat landscape: Covering the typology of botnets and their owners, the structure and lifecycle of botnets, botnet attack modes and control architectures, existing countermeasure solutions and limitations, as well as the prospects of a botnet threat. The product is a consolidation of knowledge pertaining the nature of the botnet threat; which also informs future research directions into aspects of the threat landscape where work still needs to be done.

show abstract

“…Cybercriminals rent these fast flux proxy networks to create a profitable black market hosting environment. The authors of [8,44] have analyzed the structural relationships (domain, nameserver, IP connectivity) of fast-flux botnets and identified recurrent structural clusters across different botnet types. In [8], the authors have used a social network connectivity metric to show that {Command and Control and phishing} and {malware and spam botnets} have similar structural scores using the proposed metric.…”

Section: Related Workmentioning

confidence: 99%

“…The authors of [8,44] have analyzed the structural relationships (domain, nameserver, IP connectivity) of fast-flux botnets and identified recurrent structural clusters across different botnet types. In [8], the authors have used a social network connectivity metric to show that {Command and Control and phishing} and {malware and spam botnets} have similar structural scores using the proposed metric. In this paper, we have defined metrics to capture not only the attacker behavior but also the hosting provider effort toward mitigating the malicious infrastructure located in their networks.…”

Section: Related Workmentioning

confidence: 99%

The Role of Hosting Providers in Fighting Command and Control Infrastructure of Financial Malware

Tajalizadehkhoob

Gañán

Noroozian

et al. 2017

Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

A variety of botnets are used in attacks on financial services. Banks and security firms invest a lot of effort in detecting and combating malware-assisted takeover of customer accounts. A critical resource of these botnets is their command-and-control (C&C) infrastructure. Attackers rent or compromise servers to operate their C&C infrastructure. Hosting providers routinely take down C&C servers, but the effectiveness of this mitigation strategy depends on understanding how attackers select the hosting providers to host their servers. Do they prefer, for example, providers who are slow or unwilling in taking down C&Cs? In this paper, we analyze 7 years of data on the C&C servers of botnets that have engaged in attacks on financial services. Our aim is to understand whether attackers prefer certain types of providers or whether their C&Cs are randomly distributed across the whole attack surface of the hosting industry. We extract a set of structural properties of providers to capture the attack surface. We model the distribution of C&Cs across providers and show that the mere size of the provider can explain around 71% of the variance in the number of C&Cs per provider, whereas the rule of law in the country only explains around 1%. We further observe that price, time in business, popularity and ratio of vulnerable websites of providers relate significantly with C&C counts. Finally, we find that the speed with which providers take down C&C domains has only a weak relation with C&C occurrence rates, adding only 1% explained variance. This suggests attackers have little to no preference for providers who allow long-lived C&C domains.

show abstract

Behavioral analysis of botnets for threat intelligence

Cited by 17 publications

References 10 publications

Strategically-motivated advanced persistent threat: Definition, process, tactics and a disinformation model of counterattack

Strategically-motivated advanced persistent threat: Definition, process, tactics and a disinformation model of counterattack

A Botnets Circumspection: The Current Threat Landscape, and What We Know So Far

The Role of Hosting Providers in Fighting Command and Control Infrastructure of Financial Malware

Contact Info

Product

Resources

About