Yan Chen Northwestern Lab for Internet and Security Technology (LIST) Dept. of Electrical Engineering and Computer Science Northwestern University Network-based Botnet Detection Filtering, Containment, and Destruction Motorola Liaisons Z. Judy Fu and Philip R. Roberts Motorola Labs

New Internet Attack Paradigm Botnets have become the major attack force Symantec identified an average of about 10,000 bot infected computers per day # of Botnets - increasing Bots per Botnet - decreasing –Used to be 80k-140k, now 1000s More firepower: –Broadband (1Mbps Up) x 100s = OC3 More stealthy –Polymorphic, metamorphic, etc. Residential users, e.g., cable modem users, are particularly susceptible due to poor maintenance

Birth of a Bot Bots are born from program binaries that infect your PC Various vulnerabilities can be used – viruses –Shellcode (scripts)

Botnet Distribution

Project Goal Understand the trend of vulnerabilities and exploits used by the botnets in the wild Design vulnerability based botnet detection and filtering system –Deployed at routers/base stations w/o patching the end users –Complementary to the existing intrusion detection/prevention systems –Can also contain the botnets from infecting inside machines Find the command & control (C&C) of botnets and destroy it

Limitations of Exploit Based Signature Our network Traffic Filtering Internet Signature: 10.*01 X X Polymorphic worm might not have exact exploit based signature Polymorphism!

Vulnerability Signature Work for polymorphic worms Work for all the worms which target the same vulnerability Vulnerability signature traffic filtering Internet X X Our network Vulnerability X X

Emerging Botnet Vulnerability and Exploit Analysis Large operational honeynet dataset Massive dataset on the botnet scan with payload Preliminary analysis show that the number of new exploits outpace the # of new vulnerabilities. LBLNU Sensor5 /2410 /24 Traces883GB287GB Duration37 months7 months

Vulnerability based Botnet Filtering/Containment Vulnerability Signature IDS/IPS framework Detect and filter incoming botnet Contain inside bots and quarantine infected customer machines Packet Sniffing TCP Reassembly Protocol Identification: port# or payload Protocol Parsing Vulnerability Signature Matching Single Matcher Matching Combine multiple matchers

Introduction 1-10 Residential Access: Cable Modems Diagram:

Snort Rule Data Mining NetbiosHTTPOracleSUNRPCRemainingTotal Rule%55.3%25.8 % 5.3%2.3%11.3%100% PSS%99.9%56.0 % 96.6%100%84.7%86.7 % Reduction Ratio Exploit Signature to Vulnerability Signature reduction ratio PSS means: Protocol Semantic Signature NetBios rules include the rules from WINRPC, SMB and NetBIOS protocols

Preliminary Results HTTPWINRPC Trace size558MB468MB #flows580K743K #PSS Signatures79145 #Snort Rule Covered Parsing Speed2.893Gbps15.186Gbps Parsing + Matching speed1.033Gbps13.897Gbps Experiment Setting –PC XEON 3.8GHz with 4GB memory –Real traffic after TCP reassembly preload to memory Experiment Results