1. Detecting Botnets Using Hidden Markov Models on Network Traces Wade Gobel Bio-Grid, Summer 2008

2. Bots and Botnets Malicious self-propagating program Difficult to detect Most antivirus software is signature-based Ability to communicate and coordinate with botmaster IRC HTTP Prevalence Honeypots Size is power

3. Bot Infection Security flaws Port scanning Compromised servers Increase range Allow for communication indirection

4. Bot Attacks & Profits “Renting out” a botnet Spam DDoS Click fraud Identity theft

5. Bot Detection Indicators Similar requests Synchronization Problems Potentially little traffic Potential delay between command and action

6. Hidden Markov Models

7. Initial State Probabilities

8. Transition Probabilities

9. Observation Probabilities

10. Complete HMM

11. Example States: Observations: Question: What’s the weather been like? Example courtesy of http://en.wikipedia.org/wiki/Hidden_Markov_model

12. Modeling with HMMs Only given observations Generate most likely HMM that generates the sequence of states The Baum-Welch algorithm

13. The Process Collect network data Extract some characteristic HMM models underlying state of computer / network Test for similarity between HMMs Synchronization may result in greater similarity

14. Sample Data Variation Regular / random intervals Same / Different number of bot-initiated requests Synchronization With / Without user browsing