Identifying and Characterizing Bashlite and Mirai C&amp;C Servers

Bastos, Gabriel; Meira, Wagner; Marzano, Artur; Fonseca, Osvaldo; Fazzion, Elverton; Hoepers, Cristine; Steding-Jessen, Klaus; Marcelo, H P C Chaves; Cunha, Ítalo; Guedes, Dorgival

doi:10.1109/iscc47284.2019.8969728

Cited by 11 publications

(9 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Among both download servers and C&C servers, about 70% of them were active for 5 days or less, and 90% of them were active for 14 days or less. Although some infrastructure servers survive for more than 150 days, most servers have only a short lifetime, which is consistent with prior work [11].…”

Section: Infrastructure Server Update Frequencysupporting

confidence: 88%

“…It is the same with download servers: most C&C servers were located in US and European countries, most ASes were "Data Center/Web Hosting/Transit", and most servers were located in AS14061. As in prior work, C&C servers are concentrated in cloud providers [11], [13].…”

Section: Command and Control Servermentioning

confidence: 99%

“…As an alternative to bulletproof hosting services [28], which make their servers as takedown-proof as possible, hosting C&C servers in cloud providers seems to be an attractive option [29]. Previous work suggests that we can concentrate mitigation efforts in few networks and penalize infrastructure providers that do not actively take action against these practices [11]. This might be true, but it is not clear that the attackers actually depend on these providers.…”

Section: Infrastructure Hotspotsmentioning

confidence: 99%

“…First, malware binaries are seen only briefly, often for less than one day, and that the download servers of the binaries are also short lived [10]. Second, it has been shown that command and control (C&C) servers stay online only a bit longer, typically for a handful of days, at least for Bashlite and Mirai [11]. Besides, malware rely on hard-coded IP addresses for C&C callback [12].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Disposable Botnets: Long-term Analysis of IoT Botnet Infrastructure

Tanabe

Watanabe

Fujita

et al. 2022

Journal of Information Processing

View full text Add to dashboard Cite

Large botnets made up of Internet-of-Things (IoT) devices have a steady presence in the threat landscape since 2016. However, it has not explained how attackers maintain control over their botnets. In this paper, we present a long-term analysis of the infrastructure of IoT botnets based on 36 months of data gathered via honeypots and the monitoring of botnet infrastructure. We collected 64,260 IoT malware samples, 35,494 download servers, and 4,736 C&C servers during 2016 to 2021. Not only are most binaries distributed for less than three days, but the connection of bots to the rest of the botnet is also short-lived. To reach the C&C server, the binaries typically contain only a single hard-coded IP address or domain. Long-term dynamic analysis finds no mechanism for the attackers to migrate the bots to a new C&C server. Although malware binaries that use domain names to connect to their C&C servers increased in 2020, the C&C servers themselves have a short lifespan and this tendency has not changed. The picture that emerges is that of highly disposable botnets. IoT botnets are reconstituted from scratch all the time rather than maintained.

show abstract

Section: Infrastructure Server Update Frequencysupporting

confidence: 88%

Section: Command and Control Servermentioning

confidence: 99%

Section: Infrastructure Hotspotsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Disposable Botnets: Long-term Analysis of IoT Botnet Infrastructure

Tanabe

Watanabe

Fujita

et al. 2022

Journal of Information Processing

View full text Add to dashboard Cite

show abstract

“…Mirai is now available as open source[53]. Bastos et al[54] suggested a framework to identify Mirai and Bashlite C&C servers by combining 4 heuristic algorithms.…”

mentioning

confidence: 99%

Intelligent Detection of IoT Botnets Using Machine Learning and Deep Learning

et al. 2020

View full text Add to dashboard Cite

As the number of Internet of Things (IoT) devices connected to the network rapidly increases, network attacks such as flooding and Denial of Service (DoS) are also increasing. These attacks cause network disruption and denial of service to IoT devices. However, a large number of heterogenous devices deployed in the IoT environment make it difficult to detect IoT attacks using traditional rule-based security solutions. It is challenging to develop optimal security models for each type of the device. Machine learning (ML) is an alternative technique that allows one to develop optimal security models based on empirical data from each device. We employ the ML technique for IoT attack detection. We focus on botnet attacks targeting various IoT devices and develop ML-based models for each type of device. We use the N-BaIoT dataset generated by injecting botnet attacks (Bashlite and Mirai) into various types of IoT devices, including a Doorbell, Baby Monitor, Security Camera, and Webcam. We develop a botnet detection model for each device using numerous ML models, including deep learning (DL) models. We then analyze the effective models with a high detection F1-score by carrying out multiclass classification, as well as binary classification, for each model.

show abstract

Joined Bi-model RNN with spatial attention and GAN based IoT botnet attacks detection

Muthukumaran

2023

Sādhanā

View full text Add to dashboard Cite

Currently, in many purposes machine and deep learning methods were utilized to identify bot net threats in IoT networks. On the other hand, highly imbalanced network traffic information in the training set frequently humiliates the classification. A novel method is proposed called Joined Bi-Model RNN with Spatial Attention (JBiRSA). In this work, feature generation and classification is the two major processes. For feature generation process, Generative Adversarial Network (GAN) is applied. GAN consist of two neural networks, namely Generator and Discriminator. In GAN, loss is also calculated to enhance accuracy In this model GAN with Traffic Encoder loass is proposed along with an effective generator especially suited for network traffic. Two data sets are used, namely N-BaIoT and IoT-23. N-BaIoT data set is formed by adding bot net attacks such as Bashlite and Mirai. IoT-23 data set is formed with 20 malware confines from various IoT devices and 3 precincts for benign anomalies. JBiRSA with GAN has proven to be efficient and has the potential to differentiate between benign and malicious traffic data in IoT attacks. JBiRSA with GAN provides an overall accuracy of 98.75%.

show abstract

Identifying and Characterizing Bashlite and Mirai C&C Servers

Cited by 11 publications

References 6 publications

Disposable Botnets: Long-term Analysis of IoT Botnet Infrastructure

Disposable Botnets: Long-term Analysis of IoT Botnet Infrastructure

Intelligent Detection of IoT Botnets Using Machine Learning and Deep Learning

Joined Bi-model RNN with spatial attention and GAN based IoT botnet attacks detection

Contact Info

Product

Resources

About