Reporter : 鄭志欣 Advisor: Hsing-Kuo Pao Botnet Judo: Fighting Spam with Itself

Conference 2015/12/4 2 Botnet Judo: Fighting Spam with Itself Andreas Pitsillidis, Kirill Levchenko, Christian Kreibich, Chris Kanich, Geoffrey M. Voelker, Vern Paxson, Nicholas Weaver and Stefan Savage - In Proceedings of the 17th Annual Network & Distributed System Security Symposium (NDSS), 2010.

Outline 2015/12/4 3 Introduction Template-based Spam Judo system The Signature Generator Leveraging Domain Knowledge Signature Update Evaluation Single Template Inference Multiple Template Inference Real-world Deployment Conclusion

Introduction 2015/12/4 4 Reactive Defenses Reversed engineering Black-box stream of All messages -> Regular expression Quickly producing precise mail filters

Template-based Spam 2015/12/4 5

Storm’s template Language 2015/12/4 6

Judo system 2015/12/4 7 Judo system consists of three components. Bot farm : running instances of spamming botnets in a contained environment. Signature generator : maintains a set of regular expression signatures for spam sent by each botnet. Spam filter : Updating the system

Judo spam filter model 2015/12/4 8

System Assumptions 2015/12/4 9 First and foremost, we assume that bots compose spam using a template system.

The Signature Generator 2015/12/4 10 Anchors Macros Dictionary Macros. Micro-Anchors. Noise Macros. Leveraging Domain Knowledge Header Filtering Special Tokens Signature Update Second Chance Mechanism Pre-Clustering.

Step of algorithm 2015/12/4 11

Anchors 2015/12/4 12 Extracting the longest ordered set of substrings have length at least q that are common to every messages.

Macros 2015/12/4 13 Dictionary Macros. Hypothesis test (Dictionary Test ) Micro-Anchors. a substring that consists of non-alphanumeric. Using LCS (q don’t limit) again to find Micro-Anchors. Once micro-anchors partition the text, the algorithm performs the dictionary test on each set of strings delimited by the micro- anchors. Noise Macros. generates random characters from some character set POSIX character classes or Arbitary repetition “*” or “+”

POSIX character classes 2015/12/4 14

Leveraging Domain Knowledge 2015/12/4 15 Improve the performance of the algorithm. Header Filtering Headers ignore all but the following headers: A message must match all header for a signature to be considered a match. Special Tokens Like dates,IP addresses … etc. “expire” after it was generated pre- and post- processing as anchor

Signature Update 2015/12/4 16 We would like to use a training buffer as small as necessary to generate good signatures. Train buffer is controlled by k. Second Chance Mechanism. solving the train buffer is too small. Pre-Clustering Mitigate the effects of a large training buffer.

Second Chance Mechanism 2015/12/4 17

Evaluation 2015/12/4 18 Judo is indeed safe and effective for filtering botnet- originated spam. first, spam generated synthetically from actual templates used by the Storm botnet Next,we run the Judo system on actual spam sent by four different bots, measuring its effectiveness against spam generated by the same bot. Last, deployment scenario, training and testing on different instances of the same bot.

Single Template Inference 2015/12/4 19

Multiple Template Inference 2015/12/4 20

Real-world Deployment 2015/12/4 21

Conclusion 2015/12/4 22 We have shown that it is practical to generate high-quality spam content signatures simply by observing the output of bot instances and inferring the likely conten of their underlying template.