1. CloudBot: Advanced mobile botnets using ubiquitous cloud technologies
Source: Pervasive and Mobile Computing, vol. 41, pp ,
October 2017
Author: Wei Chen, Xiapu Luo, Chengyu Yin, Bin Xiao, Man Ho Au,
Yajuan Tang
Speaker: Chit-jie Chew
Date: 3/15/2018

2. Outline Introduction Related works Proposed scheme
Experimental results
Conclusions

3. Introduction(1/2)

4. Introduction(2/3)

5. Cloud-based Push Service Cloud-based Storage Service
Introduction(3/3)-
Goals and challenges
Download Channel
Download Channel
Cloud-based Push Service
Bot
Botmaster
Upload Channel
Upload Channel
Cloud-based Storage Service

6. Related works(1/2)-Architecture of botnet
Bots
Botmaster
Network
Attack
Victim
Command
Steal data
Spam
DDoS

7. Related works(2/2)-Communication Channels
SMS
Bluetooth
HTTP

8. Proposed scheme(1/8)- Basic structure
Contactinfo
GPSinfo
Pic-upload
Applist …
Push notification service
Botmaster
(b)Command+ Registration ID+ API keys
(1)Identity information
(a)Command
(2)Registration ID
(c)Push command to bot
Sender ID
(3)Registration ID
C&C server
Bot

9. Proposed scheme(2/8)- Flat structure
(2.a)Command+ Registration ID list+ API keys from GCM
(3a)Push
Command to bots
Group 1
C&C server
(1)Command +
Target bot list
Group 2
(2.b)Command+ Registration ID list+ API keys from Parse
(3b)Push
Command to bots
Botmaster

10. (2)Command+ Registration ID list+ API keys from GCM
Proposed scheme(3/8)-
Hybrid structure
(2)Command+ Registration ID list+ API keys from GCM
(5)Push
command to bots
Group 1
C&C server
Group 2
(4)Relay
command to
bots in group
(1)Command +
Target bot list
(3)Push
command to
servant bots
···
Group n
Botmaster

11. Proposed scheme(4/8)- Hierarchy structure ······ ······ ······
C&C server
Push service
Servant bot
Push service
Push service
Push service
Client bot
······
······
······

12. Proposed scheme(5/8)- P2P structure Client bot Servant bot Client bot
Push service
Push service
Client bot
Servant bot
Client bot
Push service
Push service
Client bot
Servant bot
Client bot
Push service
Push service
Client bot
C&C server
Client bot
Push service
Push service
Client bot
Servant bot
Push service
Servant bot

13. Proposed scheme(6/8)- Bots return data to botmaster via cloud storage

14. Proposed scheme(7/8)- Selection Push server selection 1(10) 2(10)
Round-robin scheduling
1(10)
2(10)
3(10)
Weight round-robin scheduling
4(10)
5(10)
6(10)
7(10)
8(10)

15. Proposed scheme(8/8)- Selection Push server selection
Round-robin scheduling
1(4)
2(5)
3(10)
Weight round-robin scheduling
4(15)
5(16)
Servant bots selection
6(6)
7(12)
LEACH(Low-energy adaptive clustering hierarchy)
8(12)

16. Experimental results(1/6)-
Robustness mathematical analysis
(a)Blocked probability with different accounts number
(b)Disclosed probability when bots are captured

17. Experimental results(2/6)-
Botnet traffic disperse among different push servers

18. Experimental results(3/6)-
Command delay for mono-push-server botnet

19. Experimental results(4/6)-
Command delay for CloudBot download channel

20. Experimental results(5/6)-
Command delay for CloudBot upload channel

21. Experimental results(6/6)
Attack demonstration
(a)Attack demonstration
(b)Applications list

22. Conclusions
Robustness
Controllability
Scalability
Concealment

23. Thanks for listening