2009/9/151 Rishi : Identify Bot Contaminated Hosts By IRC Nickname Evaluation Reporter : Fong-Ruei, Li Machine Learning and Bioinformatics Lab In Proceedings of USENIX Workshop on Hot Topics in Understanding Botnets (HotBots), 2007

Outline Introduction Background Communication Channel Detection Results and Evaluation Conclusion 2009/9/152Machine Learning and Bioinformatics Lab

Introduction Currently  stop a given botnet is to disable the communication channel for the bots However  the hosts stay infected and are in most cases still backdoored, allowing an attacker to reclaim the machine at any time. 2009/9/15Machine Learning and Bioinformatics Lab3

Background Internet Relay Chat(IRC)  Each of the different servers hosts a number of different chat rooms called channels  Every user connected to an IRC server has its own unique username called nickname 2009/9/15Machine Learning and Bioinformatics Lab4

Background BotMaster  communicate with the botnet is to use IRC Bots  join a specific channel on a public or private IRC server  to receive further instructions 2009/9/15Machine Learning and Bioinformatics Lab5

Communication Channel Detection All bots have one characteristic in common:  they need a communication channel Our approach focuses on  detecting the communication channel between the bot and the botnet controller  it is possible to detect a bot even before it performs any malicious actions 2009/9/15Machine Learning and Bioinformatics Lab6

Project Rishi Every captured packet extracts :  Time of suspicious connection  IP address and port of suspected source host  IP address and port of destination IRC server  Channels joined  Utilized nickname 2009/9/15Machine Learning and Bioinformatics Lab7

Network setup of Rishi 2009/9/15Machine Learning and Bioinformatics Lab8

Basic Concept - Rishi 2009/9/15Machine Learning and Bioinformatics Lab9

Scoring Function Checks for the occurrence of several criteria :  suspicious substrings the name of a bot (e.g., RBOT or l33t-)  special characters like [, ], and |  long numbers. nickname consists of many digits:  for each two consecutive digits 2009/9/15Machine Learning and Bioinformatics Lab10 1 point

Scoring Function True signs for an infected host raise the final score by more than one point  a match with one of the regular expressions  a connection to a blacklisted server  the use of a blacklisted nickname 2009/9/15Machine Learning and Bioinformatics Lab11 > 1 points

Regular Expression Each nickname is tested against several regular expressions  which match known bot names For example the following expression: \[[0-9]\|[0-9]{4,}  like [0|1234]  like | /9/15Machine Learning and Bioinformatics Lab12 10 points

Whitelisting The software utilizes :  hard coded whitelist  dynamic whitelist Each nickname, which receives zero points  is added to the dynamic whitelist 2009/9/15Machine Learning and Bioinformatics Lab13

Blacklisting Two blacklists:  the first blacklist is hard coded in the configuration file  the second one is a dynamic list with nicknames added to it automatically according to the final score 2009/9/15Machine Learning and Bioinformatics Lab14

Example Imagine that the nickname  RBOT|DEU|XP-1234 was added to the blacklist The next captured nickname  RBOT|CHN|XP /9/15Machine Learning and Bioinformatics Lab15 1 point each due to the suspicious substrings RBOT,CHN, and XP 1 points each due to the two occurrences of the special character | 1 point each due to two occurrences of consecutive digits 7 points 10 points for more than 50% congruence with a name stored on the dynamic blacklist 17 points

Example 1 point each due to the suspicious substrings RBOT,CHN, and XP 1 points each due to the two occurrences of the special character | 1 point each due to two occurrences of consecutive digits 2009/9/15Machine Learning and Bioinformatics Lab16 7 points 17 points 10 points for more than 50% congruence with a name stored on the dynamic blacklist

Results and Evaluation RWTH Aachen university  30,000 computer users to support  Rishi runs on a Quad-CPU Intel Xeon 3,2Ghz system with 3GB of memory installed  we are monitoring a 10 GBit network 2009/9/15Machine Learning and Bioinformatics Lab17

Results and Evaluation 2009/9/15Machine Learning and Bioinformatics Lab18

Results and Evaluation 2009/9/15Machine Learning and Bioinformatics Lab19

Results and Evaluation 2009/9/15Machine Learning and Bioinformatics Lab20

Conclusion Based on characteristics of the communication channel  observe protocol messages  use n-gram analysis together with a scoring function  black-/whitelists 2009/9/15Machine Learning and Bioinformatics Lab21

Bot Nicknames 2009/9/15Machine Learning and Bioinformatics Lab22

Thank you for listening 2009/9/1523 The end Machine Learning and Bioinformatics Lab