A Hierarchical Hybrid Structure for Botnet Control and Command A Hierarchical Hybrid Structure for Botnet Control and Command Zhiqi Zhang, Baochen Lu, Peng Liao, Chaoge Liu, Xiang Cui - Computer Science and Automation Engineering (CSAE), 2011 IEEE International Conference Speaker : Yi-Ting Tsai Date :

Outline  Centralized Botnet  P2P Botnet  Hyprid P2P Botnet  Hierechical hybrid Botnet  Robustness Simulation  Defense against the proposed Botnet  Conclusion

Botnet Botmaster C&C Server Bot 1/14

Centralized Botnet ｘ Characteristics: relay on C&C Servers ｘ Weakness: single-failure ｘ Example: AgoBot, SDBot, SpyBot 2/14

P2P Botnet ｘ Kademlia-based protocol ｘ random probing protocol ｘ Bootstrap failure ｘ Extensive abnormal traffic 3/14 ｘ Example : Slapper botnets ｘ Example : Sinit botnets -- ｘ Sybil attack

-- Hyprid P2P Botnet ｘ servent bots : static global IP ｘ slave bots : dynamic private IP Servent bots IP Peer list Slave bots (client) Servent bots (server+client) ｘ Weakness: ｘ Sybil attack ｘ communication between clients 4/14

Hierechical hybrid Botnet 1. Resolve -- ｘ Sybil attack ｘ communication between clients 2. Difficult to be shut down 3. Keep botnet under control 5/14 Slave bots (client) Servent bots (server+client)

No Sybil attack Advanced bootstrap process No detect No hijacking 0 failure Poll succeed 1 failure Poll fail Poll succeed 2 failure Poll fail Poll succeed N-1 failure N failure Delet e Poll fail 0 failure 1 failure 2 failure N-1 failure N failure 6/14 0 failure

Peer list 0 failure 1 failure N failure.. 7/14 No Sybil attack Advanced bootstrap process No detect No hijacking

Peer list 0 failure 1 failure N failure.. Random service port || Perfect ! + Data encryption 8/14 No Sybil attack Advanced bootstrap process No detect No hijacking

ｘ Communication Encryption ｘ Command Authentication ｘ One-time padding ｘ Private key signature Public key 9/14 Private key No Sybil attack Advanced bootstrap process No detect No hijacking

Robustness Simulation Definition : the probability that a botnet remains connected together after a fraction of bots are removed. 10/14 G = ( V, E ) V : bots

Simulation settings  igraph library  Network Workbench Tool 11/14

Peer list size and Robustness Servent bots : 25% Maximum size of botnets : Bots to removed ( P ) = 95% 12/14

Defense against the proposed Botnet A.Host-based Detection Signature-based malware detection Behavior-based detection 13/14 B.Honeypot-based Monitoring

Conclusion ｘ Hierarchical hybrid p2p botnet ｘ an advanced peer list ｘ It can defend against Sybil attacks ｘ Weakness : ｘ very high complexity ｘ very high latency 14/14