Benchmarking IP blacklists for financial botnet detection

Abstract

Every day, hundreds or even thousands of computers are infected with financial malware (i.e. Zeus) that forces them to become zombies or drones, capable of joining massive financial botnets that can be hired by well-organized cybercriminals in order to steal online banking customers' credentials. Despite the fact that detection and mitigation mechanisms for spam and DDoS-related botnets have been widely researched and developed, it is true that the passive nature (i.e. low network traffic, fewer connections) of financial botnets greatly hinder their countermeasures. Therefore, cyber-criminals are still obtaining high economical profits at relatively low risk with financial botnets.In this paper we propose the use of publicly available IP blacklists to detect both drones and Command & Control nodes that are part of financial botnets. To prove this hypothesis we have developed a formal framework capable of evaluating the quality of a blacklist by comparing it versus a baseline and taking into account different metrics.The contributed framework has been tested with approximately 500 million IP addresses, retrieved during a one-month period from seven different well-known blacklist providers. Our experimental results showed that these IP blacklists are able to detect both drones and C&C related with the Zeus botnet and most important, that it is possible to assign different quality scores to each blacklist based on our metrics.Finally, we introduce the basics of a high-performance IP reputation system that uses the previously obtained blacklists' quality scores, in order to reply almost in real-time whether a certain IP is a member of a financial botnet or not. Our belief is that such a system can be easily integrated into e-banking anti-fraud systems.

A framework for financial botnet analysis

“…In previous research [9] we proved that it might be possible to discover IP addresses related to a financial botnet, by combining the information coming from well-known IP blacklists providers. In order to do so, we developed a set of metrics (i.e.…”

“…ISPs, law enforcement agencies and financial institutions) through a community-oriented online service. 2) A low-latency reputation system [9] based on IP blacklisting. This system is able to provide a scoring mechanism for determining the trustworthiness of a given IP address based on the quality of different blacklists containing that IP address.…”

“…The reputation system proposed in [9] needs to be further extended in order to meet some minimum trust and security guarantees. If it is meant to be used outside financial institution boundaries (i.e.…”

“…It is important to invest more research in order to improve the IP reputation system detection rate. As mentioned in [9], future work should take into account better reputation algorithms along with the effect of dynamic IP addresses -DHCP-.…”