WARDOG: Awareness Detection Watchdog for Botnet Infection on the Host Device

Abstract

Botnets constitute nowadays one of the most dangerous security threats worldwide. High volumes of infected machines are controlled by a malicious entity and perform coordinated cyber-attacks. The problem will become even worse in the era of the Internet of Things (IoT) as the number of insecure devices is going to be exponentially increased. This paper presents WARDOG-an awareness and digital forensic system that informs the end-user of the botnet's infection, exposes the botnet infrastructure, and captures verifiable data that can be utilized in a court of law. The responsible authority gathers all information and automatically generates a unitary documentation for the case. The document contains undisputed forensic information, tracking all involved parties and their role in the attack. The deployed security mechanisms and the overall administration setting ensures non-repudiation of performed actions and enforces accountability. The provided properties are verified through theoretic analysis. In simulated environment, the effectiveness of the proposed solution, in mitigating the botnet operations, is also tested against real attack strategies that have been captured by the FORTHcert honeypots, overcoming state-of-the-art solutions. Moreover, a preliminary version is implemented in real computers and IoT devices, highlighting the low computational/communicational overheads of WARDOG in the field.

A Survey on Botnets: Incentives, Evolution, Detection and Current Trends

“…Very botnet-specific, can introduce additional latency at network edge. [5,84,98,136,176,[201][202][203][204][205]…”

“…Legitimate traffic is accepted, while malicious ones are blocked. Many mitigation strategies use a locally installed agent on host machines to block detected botnet traffic, informing the user of the infected nature of their machine [201]. Blocking can also be performed at the edge of the service provider but would face high implementation costs and requires some coordination across ISPs [204].…”

“…Pervasive Computing Spread of botnets in home appliances 2 out 18 papers listed. [31,201] Spread of botnets in mobile phones 2 out 18 papers listed. [222,223] Spread of botnets in (non)-autonomous vehicles.…”

“…The most common trend and challenge within botnet research between 2013 and 2021 is the continued spread of botnets anchored in pervasive computing devices. With the increase in computational power within normally benign devices, such as home appliances [31,201], mobile phones [222,223] and (non)-autonomous vehicles [81,198], a higher potential of malicious activity within these devices becomes viable. As devices are allowed more computational headroom, botnets' ability to perform increasingly effective obfuscation techniques to mask their existence within pervasive devices grows ever more concerning.…”