Botnet Defense System: Concept, Design, and Basic Strategy

Abstract

This paper proposes a new kind of cyber-security system, named Botnet Defense System (BDS), which defends an Internet of Things (IoT) system against malicious botnets. The concept of BDS is “Fight fire with fire”. The distinguishing feature is that it uses white-hat botnets to fight malicious botnets. A BDS consists of four components: Monitor, Strategy Planner, Launcher, and Command and Control (C&C) server. The Monitor component watches over a target IoT system. If the component detects a malicious botnet, the Strategy Planner component makes a strategy against the botnet. Based on the planned strategy, the Launcher component sends white-hat worms into the IoT system and constructs a white-hat botnet. The C&C server component commands and controls the white-hat botnet to exterminate the malicious botnet. Strategy studies are essential to produce intended results. We proposed three basic strategies to launch white-hat worms: All-Out, Few-Elite, and Environment-Adaptive. We evaluated BDS and the proposed strategies through the simulation of agent-oriented Petri net model representing the battle between Mirai botnets and the white-hat botnets. This result shows that the Environment-Adaptive strategy is the best and reduced the number of needed white-hat worms to 38.5% almost without changing the extermination rate for Mirai bots.

Machine Learning White-Hat Worm Launcher for Tactical Response by Zoning in Botnet Defense System

“…The three research works deal with the BDS, but propose different Launchers. The Launcher of [10] gives only a basic functionality, which sends white-hat worms to the infected network. That is, it places worms at random and does not specify concrete nodes.…”

“…These two attributes ensure that the white-hat worms can destroy themselves after the Mirai bots are eliminated by them. Yamaguchi [10] proposed a promising network security system called the Botnet Defense System (BDS). It can use white-hat botnets to eliminate malicious botnets like Mirai.…”

A Survey on Botnets: Incentives, Evolution, Detection and Current Trends

“…Back in Section 4, a brief recount was made as to the reasons why IoT devices were especially popular botnet slaves. This is further explained, discussed and evaluated in a number of papers, including [82,83]. Situations such as poorly configured devices, the role of IoT in botnets as well as real life scenarios involving IoT devices capabilities for usage in attacks.…”

“…Another popular approach to mitigate botnets is to use their propagation mechanisms to propagate harmless versions of the given botnet. Actively ttacking the Mirai botnet and other IoT botnets to mitigate their threat has also been proposed [82]. Some researchers have tried to attack spam botnets to send unknowing users to more safe sites [215].…”

Botnet Defense System: Observability, Controllability, and Basic Command and Control Strategy

“…However, with the explosive growth of IoT devices, it is not practical to go around rebooting the infected devices. With the Botnet Defense System (BDS) [ 4 ], it has been proposed to use a botnet instead of humans to disinfect malicious botnets. The BDS builds a botnet itself and uses the botnet to disinfect the malicious botnet.…”