On advanced monitoring in resilient and unstructured P2P botnets

Advanced Monitoring in P2P Botnets

“…To avoid being removed from the NL of the bots, sensors must always be responsive when being probed by other bots. Moreover, the high availability of a sensor also directly influences its popularity [Kar+14], i.e., the number of bots that have the sensor in their NL. The more superpeers can verify the responsive-ness of a sensor at all time, the more bots will propagate the sensor's information to other bots.…”

“…The evaluation of LICA is outlined below and the results have been published in [Kar+14]. First, the dataset utilized for evaluating LICA is discussed in Section 5.3.2.1.…”

“…Hence, two legitimate bots with two different keys that request an NL from a bot may receive a totally different set of entries. Thus, a botnet crawler has to query each node multiple times using distinct spoofed keys, which decreases the performance of a crawler considerably [Kar+14]. Rossow et al first proposed a method to circumvent this mechanism by spoofing the querying keys randomly and to hope to obtain all neighbors eventually [Ros+13].…”

Reconstruction of C&C channel for P2P botnet

“…In the methods of crawling [14, 17] and adding sensor nodes [14, 18] for collecting data have been discussed. In these methods, if the connection information or peer‐list of each node can be collected, then the graph can also be discovered.…”

Hide and seek: Detecting sensors in P2P botnets

“…As a result, these botnets are often under particular surveillance of researchers and law enforcement agencies. As part of this monitoring activities, they are constantly crawled [3] and infiltrated by sensor nodes [4]. Crawling allows to retrieve a graph of all routable nodes in a botnet, but falls short in identifying nodes behind NAT.…”