1. A Hierarchical Hybrid Structure for Botnet Control and Command A Hierarchical Hybrid Structure for Botnet Control and Command Zhiqi Zhang, Baochen Lu, Peng Liao, Chaoge Liu, Xiang Cui - Computer Science and Automation Engineering (CSAE), 2011 IEEE International Conference Speaker : Yi-Ting Tsai Date : 102.11.7

2. Outline  Centralized Botnet  P2P Botnet  Hyprid P2P Botnet  Hierechical hybrid Botnet  Robustness Simulation  Defense against the proposed Botnet  Conclusion

3. Botnet Botmaster C&C Server Bot 1/14

4. Centralized Botnet ｘ Characteristics: relay on C&C Servers ｘ Weakness: single-failure ｘ Example: AgoBot, SDBot, SpyBot 2/14

5. P2P Botnet ｘ Kademlia-based protocol ｘ random probing protocol ｘ Bootstrap failure ｘ Extensive abnormal traffic 3/14 ｘ Example : Slapper botnets ｘ Example : Sinit botnets -- ｘ Sybil attack

6. -- Hyprid P2P Botnet ｘ servent bots : static global IP ｘ slave bots : dynamic private IP Servent bots IP Peer list --------- Slave bots (client) Servent bots (server+client) -- -- -- -- -- -- ｘ Weakness: ｘ Sybil attack ｘ communication between clients 4/14

7. Hierechical hybrid Botnet 1. Resolve -- ｘ Sybil attack ｘ communication between clients 2. Difficult to be shut down 3. Keep botnet under control 5/14 Slave bots (client) Servent bots (server+client)

8. No Sybil attack Advanced bootstrap process No detect No hijacking 0 failure Poll succeed 1 failure Poll fail Poll succeed 2 failure Poll fail Poll succeed N-1 failure N failure Delet e Poll fail 0 failure 1 failure 2 failure N-1 failure N failure 6/14 0 failure

9. Peer list 0 failure 1 failure N failure.. 7/14 No Sybil attack Advanced bootstrap process No detect No hijacking

10. Peer list 0 failure 1 failure N failure.. Random service port || Perfect ! + Data encryption 8/14 No Sybil attack Advanced bootstrap process No detect No hijacking

11. ｘ Communication Encryption ｘ Command Authentication ｘ One-time padding ｘ Private key signature Public key 9/14 Private key No Sybil attack Advanced bootstrap process No detect No hijacking

12. Robustness Simulation Definition : the probability that a botnet remains connected together after a fraction of bots are removed. 10/14 G = ( V, E ) V : bots

13. Simulation settings  igraph library  Network Workbench Tool 11/14

14. Peer list size and Robustness Servent bots : 25% Maximum size of botnets : 10000 Bots to removed ( P ) = 95% 12/14

15. Defense against the proposed Botnet A.Host-based Detection Signature-based malware detection Behavior-based detection 13/14 B.Honeypot-based Monitoring

16. Conclusion ｘ Hierarchical hybrid p2p botnet ｘ an advanced peer list ｘ It can defend against Sybil attacks ｘ Weakness : ｘ very high complexity ｘ very high latency 14/14