Revisiting Botnet Models and Their Implications for Takedown Strategies

Abstract

Abstract. Several works have utilized network models to study peerto-peer botnets, particularly in evaluating the effectiveness of strategies aimed at taking down a botnet. We observe that previous works fail to consider an important structural characteristic of networks -assortativity. This property quantifies the tendency for "similar" nodes to connect to each other, where the notion of "similarity" is examined in terms of node degree. Empirical measurements on networks simulated according to the Waledac botnet protocol, and on network traces of bots from a honeynet running in the wild, suggest that real-world botnets can be significantly assortative, even more so than social networks. By adjusting the level of assortativity in simulated networks, we show that high assortativity allows networks to be more resilient to takedown strategies than predicted by previous works, and can allow a network to "heal" itself effectively after a fraction of its nodes are removed. We also identify alternative takedown strategies that are more effective, and more difficult for the network to recover from, than those explored in previous works.

Analyzing and Modeling Longitudinal Security Data

“…We find that most botnet takedowns have limited and transient impacts on global wickedness. This result agrees with other research, which found that botnets are surprisingly resilient [81], and in many cases recover after a short time [54]. Other work has modeled malicious websites, noting the high variance of cybersecurity data, and investigates interventions through modeling [13].…”

SoK: P2PWNED - Modeling and Evaluating the Resilience of Peer-to-Peer Botnets

“…Davis et al used graph simulations to analyze the impact of bot disinfections on the communication effectiveness of P2P botnets [5]. Recently Yen and Reiter discussed the role of assortative mixing in P2P botnets and its consequences for network resilience and recovery [33]. However, to the best of our knowledge, our work is the first to introduce formal definitions for the systematization of attacks against P2P botnets.…”

Highly resilient peer-to-peer botnets are here: An analysis of Gameover Zeus

“…3. Reports from academia and industry have long warned of the high resilience potential of peer-to-peer botnets [4,5,7,19,20]. Through our analysis of the communication protocol and resilience mechanisms of P2P Zeus, we show that highly resilient P2P botnets are now a very real threat.…”