11 A First Step towards Live Botmaster Traceback Daniel Ramsbrock, Xinyuan Wang, and Xuxian Jiang - the 11th International Symposium on Recent Advances in Intrusion Detection (RAID 08), Reporter: 高嘉男 Advisor: Chin-Laung Lei 2009/12/07

2 Outline Introduction ◦ Four challenges of tracking the botmaster Botmaster traceback model Length-based watermarking scheme ◦ Basic length-based watermarking scheme ◦ Hybrid length-timing watermarking for encrypted traffic Implementation and experiment Conclusion

3 Four Challenges of Tracking the Botmaster Botmaster does not directly connect to the C&C server Low traffic volume between bot & botmaster Encryption Flow mixing

4 Tracking the Botmaster by Watermarking Botnet Traffic

5 Basic Length-based Watermarking Scheme - Watermark Bit Encoding Notation: ◦ f : packet flow of n packets P 1, …, P n ◦ -bit watermark W : w 0, …, w l-1 ◦ packet pairs: ◦ : reference packet : encoding packet ◦ l r, l e : packet lengths of encoding packet & reference packet ◦ L : bucket size Assign watermark bit w k into Encoding function

6 Watermark Bit Decoding Decoding function Decode the watermark bit

7 Watermark Collision Probability (False Positive Rate) Error tolerance ◦ f contains watermark W if Watermark collision ◦ Watermark W is found in an unwatermarked flow ◦ Collision probability Experiment: decode 1,000 unwatermarked flows Choose h = 4 False positive rate = 9.64 x 10 -6

8 Watermark Collision Probability and Distribution

9 Hybrid Length-Timing Watermarking for Encrypted Traffic Chaff messages ◦ Unwatermarked messages from other bots Unencrypted traffic Encrypted traffic ◦ Send encoding packets at a specific time ◦ Assume the network jitter δ is limited ◦ Packets used for decoding :

10 Implementation of Length-Only Algorithm (Unencrypted Traffic)

11 Implementation of Hybrid Length- Timing Algorithm (Encrypted Traffic)

12 Hybrid Length-Timing Algorithm - Encoder & Decoder Encoder ◦ Packet flow of 64 packets & 32-bit watermark ◦ Time between messages: 2 ~ 2.35 s Decoder - offset self-synchronization ◦ Determine t 1 : time of the first watermarked packet ◦ Start : t 1 = offset, incrementing t 1 by step until t 1 =(offset + max) ◦ Decode the full watermark sequence for each t 1 ◦ Record the number of bits matching the watermark W

13 Offset Self-Synchronization

14 Chaff Messages Five different chaff levels (Chaff 1 to 5) ◦ Chaff 1: time between packets = 1 ~ 2 s δ = 200 ms Sliding offset = 0 ~ 10 s

15 Conclusion It address the four major challenges: ◦ Stepping stones ◦ Encryption ◦ Flow mixing ◦ Low traffic volume between bot & botmaster It can successfully trace a watermarked flow False positive rate <= 10 -5

16 Reference Daniel Ramsbrock, Xinyuan Wang, and Xuxian Jiang, “A first step towards live botmaster traceback.”, in the 11th International Symposium on Recent Advances in Intrusion Detection (RAID 08), 2008.