1 An Advanced Hybrid Peer-to-Peer Botnet Ping Wang, Sherri Sparks, Cliff C. Zou School of Electrical Engineering & Computer Science University of Central Florida, Florida

2 Motivation Most researches target current botnets only  Rely on current botnet’s architecture, infection methods, and control network  Study current botnets is important, but not enough  May not work if botmasters upgrade their future botnets  We must study one step ahead  How botnets will evolve?  How to defend future botnets?

3 Current Botnet Control Architecture bot C&C botmaster bot C&C

4 Peer-to-Peer (P2P) based Control Architecture? C&C  P2P control is a natural evolution  P2P-based botnet is much harder to shut down But the P2P upgrade is not so simple  Current P2P protocols are not suitable  Easy exposure of botnet members  Excess traffic susceptible to detection  Bootstrap process against the design goal  Botmasters need easy control/monitor of their botnets

5 Proposed Hybrid P2P Botnet Servent bots: static IPs, able to receive connections  Static IP requirement ensures a stable, long lifetime control topology Each bot connects to its “peer list”  Only servent bot IPs are in peer lists Servent bots Client bots bot C&C botmaster bot C&C Dramatically increase the number of C&C servers

6 Botnet Command and Control Individualized encryption key  Servent bot i generates its own symmetric key K i  Any bot connecting with bot i uses K i  A bot must have ( IP i, K i ) in its peer list to conect bot i Individualized service port  Servent bot i chooses its port P i to accept connections  A bot must have ( IP i, K i, P i ) in its peer list to connect bot i Benefits to botmasters:  No global exposure if some bots are captured  Dispersed network traffic  Go through some firewalls (e.g., HTTP, SMTP, SSH holes)

7 Botnet Monitor by Botmaster Botmasters need to know their weapons  Botnet size;  bot IPs, types (e.g., DHCP ones used for spam)  Distribution, bandwidth, diurnal … Monitor via dynamical sensor  Sensor IP given in monitor command  One sensor, one shot, then destroy it  Use a sensor’s current service to blend incoming bot traffic

8 P2P Botnet Construction Botnet networked by peer list Basic procedures  New infection: pass on peer list  Reinfection: mix two peer lists  Ensure balanced connectivity

9 P2P Botnet Construction OK? No!  Real botnet is small compared to vulnerable population  Most current botnet size  20,000  Reinfection happens rarely  Not balanced topology via new infection only Simulation results:  500,000 vulnerable population  Botnet stops infection after reach 20,000  Peer list = 20, 21 initial servent bots, 5000 bots are servent bots  Results:  < 1000 reinfection events  Initial servent bots: > 14,000 in-degree  80% of servent bots: < 30 in-degree

10 P2P Botnet Construction Peer-list updating procedure  Obtain current servent bots information  Ask every bot connect to sensor to obtain a new peer list Result: all bots have balanced connectivity to servent bots used in this procedure  Use once is enough for a robust botnet  Can be used to reconnect a broken botnet

11 Botnet Robustness Study  500,000 vulnerable population, botnet = 20,000  Peer list = 20, 5000 bots are servent bots  Run peer-list updating once when having 1000 servent bots

12 Botnet Robustness Analysis C(p)=1-p M M: peer list size

13 Defense Against the Botnet Shut down a botnet before the first peer-list updating procedure  Initial servent bots are the weak points at beginning Honeypot based defense:  Poison control by pretending as servent bots  But the botnet can survive with 20% servent bots left  Clone a large set of “servent” bots

14 Monitor Against the Botnet Forensic analysis of botmaster’s sensor  Could obtain IPs of all reported bots  Challenge:  Logging of unknown port service and IP beforehand  Distinguish normal clients from reporting bots Honeypot-based monitoring  Obtain peer lists in incoming infections  Obtain many copies of new peer lists in peer-list updating procedure

15 Summary P2P based botnets are much harder to defend Proposed a hybrid P2P botnet  Two classes of bots  Individualized encryption and service port  Limited exposure by each bot  Botmaster’s monitoring capability  Peer-list updating procedure

16 Discussion Any other effective ways to monitor/defend botnets besides honeypot? Is there a way to solve the dilemma of:  No exposure of a large part of botnet?  Easy botmaster’s monitoring and botnet construction without centralized sensor? How soon will botmasters really upgrade current C&C-based architecture? How soon will botmasters care of honeypot threat?

17 Points to Add Peer-list updating can be used to change the topology of current botnet Study how honeypot monitoring changes if more and more honeypots being as servent bots  Could have an analytical model

18

19 Weaknesses of Current Botnets Control structure by one layer of C&C servers  Bottleneck in control  Susceptible to monitor/interception of C&C servers Most rely on IRC based C&C servers  Susceptible to IRC traffic based monitor/detection Other issues:  Most have no or simple encryption, authentication  Have no honeypot detection feature

20 Botnet Command and Control Command authentication  Botmaster: private key used for commands  Each bot: public key contained in bot code Can be done in current botnets Not the focus of this paper