Antisocial Networks: Turning a Social Network into a Botnet

Αθανασόπουλος, Ηλίας; Makridakis, Andreas; Antonatos, Spiros; Antoniades, Demetris; Ioannidis, Sotiris; Anagnostakis, Kostas G.; Markatos, Evangelos P.

doi:10.1007/978-3-540-85886-7_10

Cited by 45 publications

(24 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…7 When a user activated the application, it displayed an image but also embedded hidden frames with inline images hosted at a designated target. Each time the user clicked within the app, it fetched the inline images without the target's awareness.…”

Section: Related Work Mmentioning

confidence: 99%

Malicious and Spam Posts in Online Social Networks

Abu-Nimeh¹,

Alzubi

2011

Computer

View full text Add to dashboard Cite

show abstract

Section: Related Work Mmentioning

confidence: 99%

Malicious and Spam Posts in Online Social Networks

Abu-Nimeh¹,

Alzubi

2011

Computer

View full text Add to dashboard Cite

show abstract

“…In particular, [25] served as the starting point of the present study. It should be noted that the focus of the present paper is only remotely related to the abuse of social networks for other purposes [1].…”

Section: Related Workmentioning

confidence: 99%

Social Network-Based Botnet Command-and-Control: Emerging Threats and Countermeasures

Kartaltepe

Morales

et al. 2010

Applied Cryptography and Network Security

View full text Add to dashboard Cite

Abstract. Botnets have become a major threat in cyberspace. In order to effectively combat botnets, we need to understand a botnet's Command-and-Control (C&C), which is challenging because C&C strategies and methods evolve rapidly. Very recently, botmasters have begun to exploit social network websites (e.g., Twitter.com) as their C&C infrastructures, which turns out to be quite stealthy because it is hard to distinguish the C&C activities from the normal social networking traffic. In this paper, we study the problem of using social networks as botnet C&C infrastructures. Treating as a starting point the current generation of social network-based botnet C&C, we envision the evolution of such C&C methods and explore social networks-based countermeasures.

show abstract

“…These approaches, however, might be completely useless against new (or recent) appeared botnets in which their structures are moved from centralized to decentralized (peer-to-peer) and their C&C channels are evolved from IRC or HTTP to other own developed protocols based on TCP/IP stack (e.g. turning a social network into a botnet [7]); (2) How to identify applications for network traffic? Identifying network traffic as different applications is very challenging and is still an issue yet to be solved.…”

Section: Ddosmentioning

confidence: 99%

Automatic discovery of botnet communities on large-scale communication networks

Tavallaee

Ghorbani

2009

Proceedings of the 4th International Symposium on Information, Computer, and Communications Security

View full text Add to dashboard Cite

Botnets are networks of compromised computers infected with malicious code that can be controlled remotely under a common command and control (C&C) channel. Recognized as one the most serious security threats on current Internet infrastructure, advanced botnets are hidden not only in existing well known network applications (e.g. IRC, HTTP, or Peer-to-Peer) but also in some unknown or novel (creative) applications, which makes the botnet detection a challenging problem. Most current attempts for detecting botnets are to examine traffic content for bot signatures on selected network links or by setting up honeypots. In this paper, we propose a new hierarchical framework to automatically discover botnets on a large-scale WiFi ISP network, in which we first classify the network traffic into different application communities by using payload signatures and a novel cross-association clustering algorithm, and then on each obtained application community, we analyze the temporal-frequent characteristics of flows that lead to the differentiation of malicious channels created by bots from normal traffic generated by human beings. We evaluate our approach with about 100 million flows collected over three consecutive days on a large-scale WiFi ISP network and results show the proposed approach successfully detects two types of botnet application flows (i.e. Blackenergy HTTP bot and Kaiten IRC bot) from about 100 million flows with a high detection rate and an acceptable low false alarm rate.

show abstract

Antisocial Networks: Turning a Social Network into a Botnet

Cited by 45 publications

References 11 publications

Malicious and Spam Posts in Online Social Networks

Malicious and Spam Posts in Online Social Networks

Social Network-Based Botnet Command-and-Control: Emerging Threats and Countermeasures

Automatic discovery of botnet communities on large-scale communication networks

Contact Info

Product

Resources

About