Exploiting Temporal Persistence to Detect Covert Botnet Channels

Abstract

Abstract. We describe a method to detect botnet command and control traffic and individual end-hosts. We introduce the notion of "destination traffic atoms" which aggregate the destinations and services that are communicated with. We then compute the "persistence", which is a measure of temporal regularity and that we propose in this paper, for individual destination atoms. Very persistent destination atoms are added to a host's whitelist during a training period. Subsequently, we track the persistence of new destination atoms not already whitelisted in order to identify suspicious C&C destinations. A particularly novel aspect is that we track persistence at multiple timescales concurrently. Importantly, our method does not require any a-priori information about destinations, ports, or protocols used by the C&C communication, nor do we require payload inspection. We evaluate our system using extensive user traffic traces collected from an enterprise network, along with collected botnet traces.We demonstrate that our method correctly identifies a botnet's C&C traffic, even when it is very stealthy. We also show that filtering outgoing traffic with the constructed whitelists dramatically improves the performance of traditional anomaly detectors. Finally, we show that the C&C detection can be achieved with a very low false positive rate.

Active Botnet Probing to Identify Obscure Command and Control Channels

“…We verified that this is essentially the same botnet as the aforementioned botnet, as they both contacted the same IRC server 220.196.X.226, The bot observed in June contacted port 3938 while the later bot contacted the server 9 We know that it is the same botnet because the binaries use the same C&C channel. 10 At first glance, this looks like a BASE64 encoded string.…”

“…In our honeynet, we have observed at least two other commands issued by the same botnet (with different bot binaries). 9 The changes in commands reflected relocation of binary hosting websites and file names. Apparently, the original hosting site (media.pixpond.com) was no longer available, so the botmaster switched to two other websites (imgplace.com and img2.freeimagehosting.net).…”

Machine Learning Based Botnet Identification Traffic

“…Inspired by the persistency concept [16], the authors Fedynyshyn, et al [17] proposed a solution to use the persistency to detect C&C channels and classify them to their architecture (IRC, HTTP or P2P) by monitoring individual host's traffic. Garasia,et al [18] applied the Apriori association algorithm [19] to identify the presence of a C&C channel for HTTP botnets, by applying four main phases named traffic representation, filtering, separation and detection.…”

Detection of Botnet Command and Control Traffic by the Multistage Trust Evaluation of Destination Identifiers

“…Giroire et al propose detection of botnet C&C traffic by identifying new repeated combinations of traffic destinations within varying time windows [26]. This type of anomaly detection assumes C&C traffic that connects multiple times to the same destination.…”