Botnet Communication Patterns

Vormayr, Gernot; Zseby, Tanja; Fabini, Joachim

doi:10.1109/comst.2017.2749442

Cited by 122 publications

(66 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Since the work in [127] is a comprehensive taxonomy in the field of Botnet, and it discusses also related work in the Botnet context, we omit inclusion of related work prior to 2014. Moreover, other survey papers related to Botnet, such as [186,187], do not provide any feature taxonomy. Several survey papers exist in different domains of malware (excluding ransomware), such as malware interaction with operating systems [188], behavioural detection methods of malware samples [189], behaviours of the banking malware [190], mobile malware detection [191], and so on.…”

Section: Related Workmentioning

confidence: 99%

A Cyber-Kill-Chain based taxonomy of crypto-ransomware features

Dargahi

Dehghantanha

Bahrami

et al. 2019

J Comput Virol Hack Tech

View full text Add to dashboard Cite

In spite of being just a few years old, ransomware is quickly becoming a serious threat to our digital infrastructures, data and services. Majority of ransomware families are requesting for a ransom payment to restore a custodian access or decrypt data which were encrypted by the ransomware earlier. Although the ransomware attack strategy seems to be simple, security specialists ranked ransomware as a sophisticated attack vector with many variations and families. Wide range of features which are available in different families and versions of ransomware further complicates their detection and analysis. Though the existing body of research provides significant discussions about ransomware details and capabilities, the all research body is fragmented. Therefore, a ransomware feature taxonomy would advance cyber defenders' understanding of associated risks of ransomware. In this paper we provide, to the best of our knowledge, the first scientific taxonomy of ransomware features, aligned with Lockheed Martin Cyber Kill Chain (CKC) model. CKC is a well-established model in industry that describes stages of cyber intrusion attempts. To ease the challenge of applying our taxonomy in real world, we also provide the corresponding ransomware defence taxonomy aligned with Courses of Action matrix (an intelligence-driven defence model). We believe that this research study is of high value for the cyber security research community, as it provides the researchers with a means of assessing the vulnerabilities and attack vectors towards the intended victims.

show abstract

Section: Related Workmentioning

confidence: 99%

A Cyber-Kill-Chain based taxonomy of crypto-ransomware features

Dargahi

Dehghantanha

Bahrami

et al. 2019

J Comput Virol Hack Tech

View full text Add to dashboard Cite

show abstract

“…These are more general, over-the-top classes/categories of the communications structures featured by botnets; Vormayr, Zseby and Fabini [42], present a more detailed survey of the communication patterns featured by botnets. However, Table 1 comparatively highlights the differences between the C&C architectures discussed above, based on some characteristics.…”

Section: Known Botnet Control Architecturesmentioning

confidence: 99%

A Botnets Circumspection: The Current Threat Landscape, and What We Know So Far

et al. 2019

View full text Add to dashboard Cite

Botnets have carved a niche in contemporary networking and cybersecurity due to the impact of their operations. The botnet threat continues to evolve and adapt to countermeasures as the security landscape continues to shift. As research efforts attempt to seek a deeper and robust understanding of the nature of the threat for more effective solutions, it becomes necessary to again traverse the threat landscape, and consolidate what is known so far about botnets, that future research directions could be more easily visualised. This research uses the general exploratory approach of the qualitative methodology to survey the current botnet threat landscape: Covering the typology of botnets and their owners, the structure and lifecycle of botnets, botnet attack modes and control architectures, existing countermeasure solutions and limitations, as well as the prospects of a botnet threat. The product is a consolidation of knowledge pertaining the nature of the botnet threat; which also informs future research directions into aspects of the threat landscape where work still needs to be done.

show abstract

“…A botnet consists of huge number of bots, which are computing devices (such as PCs or smartphones) with network functions infected by malwares, and bots are under the control of a cyber-attacker (i.e., a bot master) [1,2]. After the botnet is constructed, the bot master periodically sends its commands (such as attack orders or malware upgrades) to bots or collects information from bots.…”

Section: Introductionmentioning

confidence: 99%

“…After the botnet is constructed, the bot master periodically sends its commands (such as attack orders or malware upgrades) to bots or collects information from bots. This periodic, persistent communication between the bot master and bots is known as botnet command and control (C&C) communication [2]. For this reason, fast, reliable, and stealthy botnet C&C communications are of critical importance for the bot master to construct and maintain a powerful botnet.…”

Section: Introductionmentioning

confidence: 99%

Construction and Performance Analysis of Image Steganography-Based Botnet in KakaoTalk Openchat

Jeon

Cho

2019

Computers

View full text Add to dashboard Cite

Once a botnet is constructed over the network, a bot master and bots start communicating by periodically exchanging messages, which is known as botnet C&C communication, in order to send botnet commands to bots, collect critical information stored in bots, upgrade software functions of malwares installed in bots, and so on. For this reason, most existing botnet detection techniques focus on monitoring and capturing suspicious communications between the bot master and bots. Meanwhile, botnets continue to evolve to hide their C&C communication. Recently, a novel type of botnet using image steganography techniques and SNS (Social Network Service) platforms, which is known as image steganography-based botnet or stegobotnet, has emerged to make its C&C communications undetectable by existing botnet detection systems. In stegobotnets, image files used in SNSs carry messages (between the bot master and bots) which are hidden in them by using image steganography techniques. In this paper, we first investigate whether major SNS platforms such as KakaoTalk, Facebook, and Twitter can be suitable for constructing image steganography-based botnets. Next, we construct a part of stegobotnet based on KakaoTalk, and conduct extensive experiments including digital forensic analysis (1) to validate stegobotnet C&C communication can be successful in KakaoTalk and (2) to examine its performance in terms of C&C communication reliability.

show abstract

Botnet Communication Patterns

Cited by 122 publications

References 41 publications

A Cyber-Kill-Chain based taxonomy of crypto-ransomware features

A Cyber-Kill-Chain based taxonomy of crypto-ransomware features

A Botnets Circumspection: The Current Threat Landscape, and What We Know So Far

Construction and Performance Analysis of Image Steganography-Based Botnet in KakaoTalk Openchat

Contact Info

Product

Resources

About