Structured Peer-to-Peer Overlay Networks: Ideal Botnets Command and Control Infrastructures?

Davis, Carlton R.; Neville, Stephen W.; Fernandez, José M.; Robert, Jean‐Marc; McHugh, John

doi:10.1007/978-3-540-88313-5_30

Cited by 33 publications

(24 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A scale-free network, which consists of a few highly-connected "hub" nodes and many "leaf" nodes, has been found to be particularly vulnerable to attacks where high-degree nodes are removed first. A takedown strategy that targets high-degree nodes is also recommended by previous works that studied botnet models [10,11,41], particularly for unstructured P2P networks where there are "super-peers" present.…”

Section: Related Workmentioning

confidence: 99%

“…We first focus on strategies explored in previous works that study botnet models [10,11,41,19]: -Uniform takedown: removing nodes from the network by selecting them uniformly at random. -Degree-based takedown: removing nodes from the network in descending order of node degree, that is, targeting high-degree nodes first.…”

Section: Uniform and Degree-based Takedown Strategiesmentioning

confidence: 99%

“…This allows the effectiveness of takedown strategies to be quantitatively evaluated using graph properties, such as the network diameter, the average shortest distance between pairs of nodes, and the size of the largest connected component. Davis et al [11] compared Overnet, which is utilized by the Storm botnet [31,16], with random and scale-free networks to justify the choice of structured P2P networks made by bot-masters. They simulated takedown efforts on the networks by removing nodes at random, in descending order of node degree, or in a "tree-like" fashion by identifying nodes reachable from an initial node, and found Overnet to be more resilient than other graph models.…”

Section: Related Workmentioning

confidence: 99%

“…Recently, several works have also applied graph models from network theory to study peer-to-peer (P2P) botnets [10,11,41,19]. Each node in the network represents an infected host, and edges reflect communications between the hosts.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Revisiting Botnet Models and Their Implications for Takedown Strategies

Yen

Reiter

2012

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Several works have utilized network models to study peerto-peer botnets, particularly in evaluating the effectiveness of strategies aimed at taking down a botnet. We observe that previous works fail to consider an important structural characteristic of networks -assortativity. This property quantifies the tendency for "similar" nodes to connect to each other, where the notion of "similarity" is examined in terms of node degree. Empirical measurements on networks simulated according to the Waledac botnet protocol, and on network traces of bots from a honeynet running in the wild, suggest that real-world botnets can be significantly assortative, even more so than social networks. By adjusting the level of assortativity in simulated networks, we show that high assortativity allows networks to be more resilient to takedown strategies than predicted by previous works, and can allow a network to "heal" itself effectively after a fraction of its nodes are removed. We also identify alternative takedown strategies that are more effective, and more difficult for the network to recover from, than those explored in previous works.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Uniform and Degree-based Takedown Strategiesmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Revisiting Botnet Models and Their Implications for Takedown Strategies

Yen

Reiter

2012

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…From the attacker's viewpoint, in terms of efficiency, Kad has the most efficient routing: contacting O(log N ) nodes during a search (where N is the size of the network); the modified Chord can achieve O(log 2 N ) hops; and the simple ring is the worst, requiring O(N ) steps. From resilience's perspective, the Kad network is shown to be robust to a few types of mitigation strategies such as cutting off random nodes and removing peers learnt from bots' peer lists [5]; the simple ring structure is evidently fragileremoving a couple of nodes can disconnect the overlay; and the modified Chord structure hits the middle ground: not as resilient as Kad but better than the simple ring. We believe that, while constructing a P2P botnet, the attacker needs to strike a balance between resilience or efficiency and the ability to evade detection.…”

Section: Insights From Analysismentioning

confidence: 99%

Measuring the effectiveness of infrastructure-level detection of large-scale botnets

Zeng¹,

Yan²,

Eidenbenz³

et al. 2011

2011 IEEE Nineteenth IEEE International Workshop on Quality of Service

View full text Add to dashboard Cite

Abstract-Botnets are one of the most serious security threats to the Internet and its end users. In recent years, utilizing P2P as a Command and Control (C&C) protocol has become popular due to its decentralized nature that can help hide the botmaster's identity. Most bot detection approaches targeting P2P botnets either rely on behavior monitoring or traffic flow and packet analysis, requiring fine-grained information collected locally. This requirement limits the scale of detection. In this paper, we consider detection of P2P botnets at a high-levelthe infrastructure level-by exploiting their structural properties from a graph analysis perspective. Using three different P2P overlay structures, we measure the effectiveness of detecting each structure at various locations (the Autonomous System (AS), the Point of Presence (PoP), and the router rendezvous) in the Internet infrastructure.

show abstract

NoBot: Embedded malware detection for endpoint devices

Menten¹,

Chen²,

Stiliadis

2011

Bell Labs Tech. J.

View full text Add to dashboard Cite

and implemented as a preprocessor module for the open source Snort Intrusion detection and prevention System (IDS/IPS). © 2011 Alcatel-Lucentoccasionally become, themselves, the cause of operating system damage and denial of service [6,14]. At the same time, the effectiveness of centrally-placed intrusion detection and prevention systems (IDS/IPS), which attempt to discover infected systems and attacks by monitoring the aggregate traffic of many end systems, continues to diminish with the growth in traffic volume, and with the increasing sophistication of malware and the botnets within which they operate [2,13]. Signature-based solutions will always lag behind the deployment of new malware variants and attempts at achieving zero-day detection and prevention of malware have had disappointing results.Although one can reduce the frequency of attack with firewalls, IDS/IPS, and host-based protections,

show abstract

Structured Peer-to-Peer Overlay Networks: Ideal Botnets Command and Control Infrastructures?

Cited by 33 publications

References 14 publications

Revisiting Botnet Models and Their Implications for Takedown Strategies

Revisiting Botnet Models and Their Implications for Takedown Strategies

Measuring the effectiveness of infrastructure-level detection of large-scale botnets

NoBot: Embedded malware detection for endpoint devices

Contact Info

Product

Resources

About