1. Yan Chen Northwestern Lab for Internet and Security Technology (LIST) Dept. of Electrical Engineering and Computer Science Northwestern University http://list.cs.northwestern.edu Network-based Botnet Detection Filtering, Containment, and Destruction Motorola Liaisons Z. Judy Fu and Philip R. Roberts Motorola Labs

2. New Internet Attack Paradigm Botnets have become the major attack force Symantec identified an average of about 10,000 bot infected computers per day # of Botnets - increasing Bots per Botnet - decreasing –Used to be 80k-140k, now 1000s More firepower: –Broadband (1Mbps Up) x 100s = OC3 More stealthy –Polymorphic, metamorphic, etc. Residential users, e.g., cable modem users, are particularly susceptible due to poor maintenance

3. Birth of a Bot Bots are born from program binaries that infect your PC Various vulnerabilities can be used –E-mail viruses –Shellcode (scripts)

4. Botnet Distribution

5. Project Goal Understand the trend of vulnerabilities and exploits used by the botnets in the wild Design vulnerability based botnet detection and filtering system –Deployed at routers/base stations w/o patching the end users –Complementary to the existing intrusion detection/prevention systems –Can also contain the botnets from infecting inside machines Find the command & control (C&C) of botnets and destroy it

6. Limitations of Exploit Based Signature 1010101 10111101 11111100 00010111 Our network Traffic Filtering Internet Signature: 10.*01 X X Polymorphic worm might not have exact exploit based signature Polymorphism!

7. Vulnerability Signature Work for polymorphic worms Work for all the worms which target the same vulnerability Vulnerability signature traffic filtering Internet X X Our network Vulnerability X X

8. Emerging Botnet Vulnerability and Exploit Analysis Large operational honeynet dataset Massive dataset on the botnet scan with payload Preliminary analysis show that the number of new exploits outpace the # of new vulnerabilities. LBLNU Sensor5 /2410 /24 Traces883GB287GB Duration37 months7 months

9. Vulnerability based Botnet Filtering/Containment Vulnerability Signature IDS/IPS framework Detect and filter incoming botnet Contain inside bots and quarantine infected customer machines Packet Sniffing TCP Reassembly Protocol Identification: port# or payload Protocol Parsing Vulnerability Signature Matching Single Matcher Matching Combine multiple matchers

10. Introduction 1-10 Residential Access: Cable Modems Diagram: http://www.cabledatacomnews.com/cmic/diagram.html

11. Snort Rule Data Mining NetbiosHTTPOracleSUNRPCRemainingTotal Rule%55.3%25.8 % 5.3%2.3%11.3%100% PSS%99.9%56.0 % 96.6%100%84.7%86.7 % Reduction Ratio 67.61.21.62.61.74.5 Exploit Signature to Vulnerability Signature reduction ratio PSS means: Protocol Semantic Signature NetBios rules include the rules from WINRPC, SMB and NetBIOS protocols

12. Preliminary Results HTTPWINRPC Trace size558MB468MB #flows580K743K #PSS Signatures79145 #Snort Rule Covered9742000+ Parsing Speed2.893Gbps15.186Gbps Parsing + Matching speed1.033Gbps13.897Gbps Experiment Setting –PC XEON 3.8GHz with 4GB memory –Real traffic after TCP reassembly preload to memory Experiment Results