Exploring Infected-host Enumeration Methods for Advanced Peer-to-Peer Botnets
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
In this study, we present methods for discovering infected hosts participating in modern botnets that utilize peer-topeer based architectures for command-and-control communication. We also discuss the design considerations of the infected-host enumeration methods along with metrics to describe their performance in terms of stealthiness, efficiency,accuracy, and robustness. With consideration of these metrics, a case study is included which explore the utility of several of these enumeration methods when applied to a real-world botnet that uses tiered peer-to-peer based architectures. We hope this survey of enumeration techniques and the included case study: serve as a roadmap and general reference for rapidly designing and deploying effective enumeration tools for future advanced botnets.
Abstract
In this study, we present methods for discovering infected hosts participating in modern botnets that utilize peer-topeer based architectures for command-and-control communication. We also discuss the design considerations of the infected-host enumeration methods along with metrics to describe their performance in terms of stealthiness, efficiency,accuracy, and robustness. With consideration of these metrics, a case study is included which explore the utility of several of these enumeration methods when applied to a real-world botnet that uses tiered peer-to-peer based architectures. We hope this survey of enumeration techniques and the included case study: serve as a roadmap and general reference for rapidly designing and deploying effective enumeration tools for future advanced botnets.
참고문헌 (21)
- L. Bilge, "DISCLOSURE: Detecting Botnet Command and Control Servers Through Large-Scale NetFlow Analysist", ACSAC 2012: Annual Computer Security Applications Conference (2012)
- J. Calvet, "Malware Authors Don't Learn, and That's Good", MALWARE 2009: The Fourth Annual Conference on Malicious and Unwanted Software (2009)
- E. Cooke, "The Zombie Roundup: Understanding, detecting, and disrupting botnets", Usenix Workshop on Steps to Reducing Unwanted Traffic on the Internet, pp.39~44 (2006)
- D. Dagon, "A taxonomy of botnet structures", Proceedings of the 23rd Annual Computer Security Applications Conference (2007)
- J. Grizzard, "Peerto-peer botnets: Overview and case study", Usenix First Workshop on Hot Topics in Understanding Botnets (2007)
- G. Gu, "Both-unter: Detecting malware infection through ids-driven dialog cor-relation", Proceedings of The 16th USENIX Security Symposium. USENIX Association (2007)
- T. Holz, "Measurements and Mitigation of Peer-to- Peer-based Botnets: A Case Study on Storm Worm", Proceedings of the First USENIX Workshop on Large Scale Exploits and Emergent Threats (2008), USENIX Association
- B. B. Kang, "Towards complete node enumeration in a peer-to-peer botnet", ASIACCS '09: ACM Symposium on Information, Computer and Communication Security (2009)
- C. Kanich, "The Heisenbot uncertainty problem: Challenges in separating bots from chaff", Proceedings of the First USENIX Workshop on Large Scale Exploits and Emergent Threats (2008)
- S. Lee, "Fluxing botnet command and control channels with url shortening services" (2012), Fluxing botnet command and control channels with url shortening services
- J. Nazario, "As the Net Churns : Fast-Flux Botnet Observations, In As the Net Churns: Fast- Flux Botnet Observations", MALWARE '09: The Third Annual Conference on Malicious and Unwanted Software (2008)
- C. Nunnery, "Tumbling down the rabbit hole: Exploring the idiosyncrasies of botmaster systems in a multi-tier botnet infrastructure", Proceedings of the Third USENIX Workshop on Large Scale Exploits and Emergent Threats (2010)
- M. Rajab, "A multifaceted approach to understanding the botnet phenomenon", Proceedings of the USENIX Internet Measurement Conference (2006)
- "Blog Post: Waledac's Communication Protocol"[URL]
- G. Sinclair, "The Waledac Protocol: The How and Why", MALWARE 2009: The Fourth Annual Conference on Malicious and Unwanted Software (2009)
- "Protocols and encryption of the storm botnet"[URL]
- "Storm worm ddos attack"[URL]
- B. Stock, "Walowdac Analysis of a Peer-to-Peer Botnet", EC2ND 2009: European Conference on Computer Network Defense (2009)
- S. Stover, "Analysis of the Storm and Nugache trojans -P2P is here", Login, 32(6) (2007)
- "Team Cymru. The Team Cymru Bogon List v4.8 30"[URL]
- F. Tegeler, "Botfinder: Finding bots in network traffic without deep packet inspection", ~ (2012)