Under the Shadow of Sunshine: Understanding and Detecting Bulletproof Hosting on Legitimate Service Provider Networks Sumayah Alrwais, Xiaojing Liao, Xianghang Mi, Peng Wang, XiaoFeng Wang, Feng Qian, Raheem Beyah and Damon McCoy Presented by: Jay Lakhupota

Highlights Study of the new trend of Bulletproof Hosting services (BPH). Identifying the new features that uniquely characterizes the BPH on sub- allocations. Training the classifiers to detect the malicious sub-allocated network blocks. Study of the detected malicious network blocks and the magnitude of this problem.

Motivation Bulletproof Hosting is a stable base of operation for attackers to conduct the illicit operations such as hosting botnet command and control, launching DDoS attacks and phishing etc. To prevent ourselves from such malicious activities, it is important to know the platform on which these activities are conducted.

Background What is Bulletproof Hosting Service? Bulletproof hosting operations are similar to regular web hosting, however these companies are a lot more lenient about what can be hosted on their servers. It has somewhat of a “don’t ask, don’t tell” philosophy.  (Source: Norton)

Problem Establishment of reseller relationship with lower end hosting service providers. Better reputation of parent providers, as a result gives a mix of both legitimate and BPH resellers. Quickly enables the client to move to another IP when detected. Blacklisting lower end service provider would cause a major damage which is not feasible.

Problem(conti….) Figure 1: BPH Ecosystem

Solution The processing of the work flow is as follows:

Data Collection Other source of information are: The main two data sets of information are: WHOIS: Keeps the logs and record all the information of network block. PDNS (Passive Domain Name Server): Has the information regarding the sub- allocations and their corresponding IP addresses. Other source of information are: Blacklist: has three types of list which are CleanMX, SpamHaus Edrop and BL-A. Ground Truth: two ways used in generating the labelled sets those are: Finding clean sub-allocations, finding malicious sub-allocations.

Data Processing There were basically four stages for data processing: Finding sub-allocations: Used the WHOIS data to generate hierarchy network tree for each network block. Identifying sub-allocations owners: Considering the owner object from WHOIS data and comparing it with the owner object of all of its parent object. Filtering sub-allocations: Selecting the sub-allocations that hosts more than 10 TLD+3 and are utilizing more than 25% of the network block. Feature selection and extraction: Uses PDNS, WHOIS and AS to extract the information for training the classifier.

Evaluation To evaluate they used two types of label sets: Highly conservative set Noisier set And a larger unlabelled set Training classifiers: To train classifiers they used two labelled sets Set A and Set B which contains both clean and malicious samples. Evaluation on Labelled Datasets: Uses 5-fold cross validation to evaluate the set with the help of two classifiers i.e. Support Vector Mechanism(SVM) and Random Forest(RF). They were unable to obtain an accurate result due to noise present in those large data set.

Evaluation(conti…) Evaluation on Unlabelled Set: Run the two trained models Set A and Set B on larger unlabelled set of sub-allocations. As a result they detected 40k(20%) and 20k(10%) sub-allocations from the trained models. Manual Sampling: sample the sub-allocations and investigate them case by case looking for evidence of False Positive.

Exploring the BPH Ecosystem Upon running the detector they detected 39k sub-allocations in total, averaging 20k(10%) per processed snapshot. This high percentage of sub-allocations shows that the operation of BPH services uses WHOIS de-listing method to avoid the detection by de-listing from WHOIS record. Using this information they studied the role of service providers and the sub-allocations owners to avoid the AS based detection method.

Limitations Ground truth: It was unclear as to which sub-allocations are run by BPH services and how much malicious activities are actually happening on these sub-allocations. Scope of detection: They were unable to tell the overall infrastructure of BPH services. Robustness of Detection: As the processing time for detection was long so they will not be able to find the service providers which are colluding actively. Apart from that I think the some results that they obtained were not totally accurate. They had to use these result as estimates of performance.

Future Work As the authors said that this was just a start point for classifying and analysing these BPH services. So it would be better to create a system where the processing time is reduced and can detect the malicious network such that when the service provider is colluding with these BPH services.

Any Questions? Thank you