Mitigating Peer-to-Peer Botnets by Sybil Attacks

Zhou, Hangxia

doi:10.1109/cicc-itoe.2010.67

Cited by 5 publications

(5 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A Sybil attack [43] is an effective method to terminate P2P botnets by creating many fake identities and inserting them into the bot's routing table to re-route the command queries and eventually disrupt the botmaster's C&C communication. Although P2P botnets are vulnerable to this kind of attack, our model was not as the bots did not connect with each other.…”

Section: The Resilience Against Sybil Attacksmentioning

confidence: 99%

BlockchainBot: A Novel Botnet Infrastructure Enhanced by Blockchain Technology and IoT

Gao

Chang³

et al. 2022

Electronics

View full text Add to dashboard Cite

Although the traditional P2P botnet has significant resilience against termination, its dependence on neighbor lists (NL) has left it vulnerable to infiltration and destruction. In addition, it is not sufficient in protecting the botmaster’s identity. To overcome these weaknesses, we proposed BlockchainBot, a botnet model that leveraged IoT devices as maintainers, and integrated blockchain, also known as distributed ledger technology (DLT). The BlockchainBot was able to fully deploy bots on public blockchains. It was versatile for multiple botnet applications and eliminated the dependence on NL. In addition, we further introduced a novel method, the forking of a channel, to kick out spy nodes that infiltrate a botnet. To further enforce the resistance against a single point of failure (SPoF), we introduced bot-cluster dispersing to prevent clustering around full nodes and more evenly scatter bots to prevent hostile takeovers. The analysis of the security of BlockchainBot indicated that it had strong resilience against DDoS attacks, Sybil attacks, and forensic investigations. Furthermore, the security of the forking of the channel and bot-cluster dispersing were also shown to be effective. The robustness of the BlockchainBot against the Sybil attack was also briefly discussed. Experimental results authenticated the effectiveness and performance of the BlockchainBot, as compared to previous models.

show abstract

Section: The Resilience Against Sybil Attacksmentioning

confidence: 99%

BlockchainBot: A Novel Botnet Infrastructure Enhanced by Blockchain Technology and IoT

Gao

Chang³

et al. 2022

Electronics

View full text Add to dashboard Cite

show abstract

“…One other technique proposed in the work by Hangxia et al [103] takes advantage of the vulnerability posed by the fact that nodes can join a P2P botnet without any way of confirming whether they were honest nodes or not. In this technique, the routing table of botnets are poisoned (compromised by infiltration) with nodes information; thereby causing it to re-route the command Some modern techniques have also proposed improvements to some of the pitfalls posed by some analysis-based techniques, in order to enhance their potency and reduce the number of false positives generated, such as Huang (2013) [98], Narang et al [99] and in Narang et al [100].…”

Section: Exploit/take Downmentioning

confidence: 99%

“…One other technique proposed in the work by Hangxia et al [103] takes advantage of the vulnerability posed by the fact that nodes can join a P2P botnet without any way of confirming whether they were honest nodes or not. In this technique, the routing table of botnets are poisoned (compromised by infiltration) with nodes information; thereby causing it to re-route the command information from the attacker to possibly non-existent nodes, and disrupting C&C communication, thereby mitigating the impact of the botnet.…”

Section: Exploit/take Downmentioning

confidence: 99%

A Botnets Circumspection: The Current Threat Landscape, and What We Know So Far

et al. 2019

View full text Add to dashboard Cite

Botnets have carved a niche in contemporary networking and cybersecurity due to the impact of their operations. The botnet threat continues to evolve and adapt to countermeasures as the security landscape continues to shift. As research efforts attempt to seek a deeper and robust understanding of the nature of the threat for more effective solutions, it becomes necessary to again traverse the threat landscape, and consolidate what is known so far about botnets, that future research directions could be more easily visualised. This research uses the general exploratory approach of the qualitative methodology to survey the current botnet threat landscape: Covering the typology of botnets and their owners, the structure and lifecycle of botnets, botnet attack modes and control architectures, existing countermeasure solutions and limitations, as well as the prospects of a botnet threat. The product is a consolidation of knowledge pertaining the nature of the botnet threat; which also informs future research directions into aspects of the threat landscape where work still needs to be done.

show abstract

“…They also study the effect of the sybil nodes sizes in attacking P2P botnet. Their proposed method has been evaluated by simulation and theoretically (Hangxia, 2010).…”

Section: Mitigating Peer-to-peer Botnets By Sybil Attacksmentioning

confidence: 99%

“…They evaluate this approach in both simple and realistic cases and achieve an encouraging good detection rate of C&C channel (Chang and Daniels, 2009). Gu et al (2008) Proposed a general botnet detection BotMiner can be useful for framework named BotMiner, based on detecting IRC botnet, but it is clustering analysis of network traffic not effective for detecting P2P botnet Masud et al (2008) Proposed a general botnet detection BotMiner can be useful for detecting framework named BotMiner, based botnet, but it is not effective for on clustering analysis of network traffic detecting P2P botnet Noh et al (2009) They consider the network traffic as They have better detection accuracy infinite data stream and use data mining than other data stream classification techniques to detect P2P botnet techniques Kang and Zhang (2009) Propose using a multi-phased flow The proposed system shows the model to detect malicious traffic efficiency with the SpamThru, Storm and Nugache botnets Kang and Zhang (2009) Applying the information entropy theory The results show that the entropy theory In the detection Multi-chart CUS UM to has its own advantages in detecting detect new P2P botnets P2P botnets Chang and Daniels (2009) Present two detection schemes using The proposed algorithms achieve an behavior clustering and statistical tests encouraging good detection rate of clustering and statistical tests C&C channel Chen et al (2009) Propose a detection method of P2P Effective in detecting the controlled bots controlled bots on the hosts, using API on the host, but has few limitations as the function calls and algorithms to process APIs large training set required to improve the detection accuracy Hangxia (2010) They propose mitigating P2P botnets using The results show that sybil attack technique Two Sybil attacks, based on analyzing can be quite effective to defend botnets' weaknesses against P2P botnets Liu et al (2010) Present a general P2P detection model and It can be used to detect unknown protocol algorithms based on network stream analysis P2P botnets effectively Al-Hammadi and Aickelin (2010) Developed an algorithm to detect P2P bots…”

Section: Behavior Clustering and Statistical Testsmentioning

confidence: 99%

A Review of Peer-to-Peer Botnet Detection Techniques

Elhalabi¹,

Manickam²,

Melhim³

et al. 2014

Journal of Computer Science

View full text Add to dashboard Cite

In recent years, Peer-to-Peer technology has an extensive use. Botnets have exploited this technology efficiently and introduced the P2P botnet, which uses P2P network for remote control of its bots and become one of the most significant threats to computer networks. They are used to make DDOS attacks, generate spam, click fraud and steal sensitive information. Compared with traditional botnets, P2P botnets are harder to be defended and hijacked. In this study we discuss various P2P botnet detection approaches and evaluate their effectiveness. We identify the advantages and shortcomings of each of the discussed techniques. This can guide the researchers to a better understanding of P2P botnets and easier for them developing more sufficient detection techniques. Our evaluation shows that each technique has its own advantages and limitations. Two or more detection techniques might be used together, in order to have a robust P2P botent detection.

show abstract

Mitigating Peer-to-Peer Botnets by Sybil Attacks

Cited by 5 publications

References 1 publication

BlockchainBot: A Novel Botnet Infrastructure Enhanced by Blockchain Technology and IoT

BlockchainBot: A Novel Botnet Infrastructure Enhanced by Blockchain Technology and IoT

A Botnets Circumspection: The Current Threat Landscape, and What We Know So Far

A Review of Peer-to-Peer Botnet Detection Techniques

Contact Info

Product

Resources

About