Hide and seek: Detecting sensors in P2P botnets

Advanced Monitoring in P2P Botnets

“…Andriesse et al reported that sensors are a more stealthy monitoring mechanism than crawlers due to their indistinguishableness from benign bots [ARB15]. Although many sensors are observed to be highly popular, i.e., known by many bots and highly reliable in the botnet [Böc+15], this behavior is indistinguishable from popular bots. Due to this reason, not much work has been done previously in the scope of detecting sensors that are deployed in botnets.…”

“…Such values indicate that neighbors of a bot v are not connected at all or connected in a full mesh respectively. As the majority of bots have common neighbors in the form of reliable backbone nodes [Böc+15], it is unlikely that a bot could have neighbors that are not inter-connected at all, i.e., lcc + (v) = 0.0. Therefore, it could only be of sensors that refuse to share any neighbors or those that shared non-existent neighbors.…”