AntBot: Anti-pollution peer-to-peer botnets

Yan, Guanhua; Ha, Duc T.; Eidenbenz, Stephan

doi:10.1016/j.comnet.2011.02.006

Cited by 17 publications

(11 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Hypothetical botnets proposed previously include Super-Botnet [27], Overbot [20], AntBot [30], and hybrid P2P botnets [28]. Our work differs from these work on two aspects.…”

Section: Related Workcontrasting

confidence: 43%

RatBot: Anti-enumeration Peer-to-Peer Botnets

Yan

Chen

Eidenbenz

2011

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. As evidenced by the recent botnet turf war between SpyEye and Zeus, the cyber space has been witnessing an increasing number of battles or wars involving botnets among different groups, organizations, or even countries. One important aspect of a cyber war is accurately estimating the attack capacity of the enemy. Particularly, each party in a botnet war would be interested in knowing how many compromised machines his adversaries possess. Towards this end, a technique often adopted is to infiltrate into an adversary's botnet and enumerate observed bots through active crawling or passive monitoring methods. In this work, we study potential tactics that a botnet can deploy to protect itself from being enumerated. More specifically, we are interested in how a botnet owner can bluff the botnet size in order to intimidate the adversary, gain media attention, or win a contract. We introduce RatBot, a P2P botnet that is able to defeat existing botnet enumeration methods. The key idea of RatBot is the existence of a fraction of bots that are indistinguishable from their fake identities. RatBot prevents adversaries from inferring its size even after its executables are fully exposed. To study the practical feasibility of RatBot, we implement it based on KAD, and use large-scale high-fidelity simulation to quantify the estimation errors under diverse settings. The results show that a naive enumeration technique can significantly overestimate the sizes of P2P botnets. We further present a few countermeasures that can potentially defeat RatBot's anti-enumeration scheme.

show abstract

“…Hypothetical botnets proposed previously include Super-Botnet [27], Overbot [20], AntBot [30], and hybrid P2P botnets [28]. Our work differs from these work on two aspects.…”

Section: Related Workcontrasting

confidence: 43%

RatBot: Anti-enumeration Peer-to-Peer Botnets

Yan

Chen

Eidenbenz

2011

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…Therefore, we describe our results such that they cannot be directly applied by botmasters to harden their botnets. On a reassuring note, several detailed strategies for resilient P2P botnet designs have been publicly proposed, but we do not know of any real botnets that make use of these ideas [22,31,32,10]. We believe that the potential of our work to assist security experts justifies its publication.…”

Section: Discussion and Future Workmentioning

confidence: 99%

“…Note that all recent P2P botnets have unstructured P2P protocols, that is, they use message gossiping to propagate information. To date, most academic work on P2P botnets has focused on structured architectures [22,31,32,10]. Bots in structured P2P botnets typically maintain a distributed hash table that is used to store and route commands.…”

Section: A P2p Botnet Characteristicsmentioning

confidence: 99%

See 1 more Smart Citation

SoK: P2PWNED - Modeling and Evaluating the Resilience of Peer-to-Peer Botnets

Rossow¹,

Andriesse

Werner³

et al. 2013

2013 IEEE Symposium on Security and Privacy

140

122

View full text Add to dashboard Cite

Centralized botnets are easy targets for takedown efforts by computer security researchers and law enforcement. Thus, botnet controllers have sought new ways to harden the infrastructures of their botnets. In order to meet this objective, some botnet operators have (re)designed their botnets to use Peer-to-Peer (P2P) infrastructures. Many P2P botnets are far more resilient to takedown attempts than centralized botnets, because they have no single points of failure. However, P2P botnets are subject to unique classes of attacks, such as node enumeration and poisoning. In this paper, we introduce a formal graph model to capture the intrinsic properties and fundamental vulnerabilities of P2P botnets. We apply our model to current P2P botnets to assess their resilience against attacks. We provide assessments on the sizes of all eleven active P2P botnets, showing that some P2P botnet families contain over a million bots. In addition, we have prototyped several mitigation strategies to measure the resilience of existing P2P botnets. We believe that the results from our analysis can be used to assist security researchers in evaluating mitigation strategies against current and future P2P botnets.

show abstract

“…A detailed description of Peacomm is presented by Ref [11]. They also investigate how to detect the Storm bot by using a BotHunte, which tracks the two-way communication flows between internal and external entities to find the infected host [12].…”

Section: Introductionmentioning

confidence: 99%