P2P as botnet command and control: A deeper insight

3rd International Conference on Malicious and Unwanted Software, MALWARE 2008

Volumn , Issue , 2008, Pages 41-48

  Dittrich, David ^a,b   Dietrich, Sven ^a,b  

^a UNIVERSITY OF WASHINGTON   (United States)

^b STEVENS INSTITUTE OF TECHNOLOGY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BOTNETS; COMMAND AND CONTROLS; INCREMENTAL IMPROVEMENTS; MALICIOUS SOFTWARES; P2P FILE SHARING; P2P TECHNOLOGIES; PEER TO PEERS; RESEARCH COMMUNITIES;

COMPUTER CRIME; CONCURRENCY CONTROL; DISTRIBUTED COMPUTER SYSTEMS;

COMPUTER NETWORKS;

EID: 58149088212     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/MALWARE.2008.4690856     Document Type: Conference Paper

References (30)

1. R. Bhagwan, S. Savage, and G. Voelker. Understanding availability. In Proc. of the 2nd International Workshop
2. on Peer-to-Peer Systems, LNCS 2735. Springer Verlag, February 2003.
3. E. Cooke, F. Jahanian, and D. McPherson. The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets. In SRUTI05: Proceedings of the Steps to Reducing Unwanted Traffic on the Internet Workshop, 2005.
4. D. Dittrieh and S. Dietrich. Discovery techniques for P2P botnets. Technical Report CS 2008-4, Stevens Institute of Technology, September 2008.
5. D. Dittrieh and S. Dietrich. New directions in P2P mal-ware. In Proceedings of the 2008 IEEE Sarnoff Symposium, page 5, Princeton, New Jersey, USA, April 2008.
6. D. Dittrieh and S. Dietrich. Technical Report CS 2008-3. Stevens Institute of Technology, June 2008.
7. D. Fischer. Storm, Nugache lead dangerous new botnet barrage. SearchSecurity.com, December 2007. http://searchsecurity.techtarget.com/ news/article/0,289142,sidl4.gcil286808,00.html.
8. G. Gu, R. Perdisci, J. Zhang, and W. Lee. BotMiner: Clustering analysis of network traffic for protocol- and structure-independent botnet detection. In Proceedings of the 17th USENIX Security Symposium (Security'08), July 2008.
9. T. Holz. A short visit to the bot zoo. IEEE Security & Privacy Magazine, 3(3):76-79, May-June 2005.
10. T. Holz, M. Steiner, F. Dahl, E. W. Biersack, and F. Freil-ing. Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm. In LEET'08: First USENIX Workshop on Large-Scale Exploits and Emergent Threats, April 15, 2008, San Francisco, CA, USA, April 2008.
11. B. Kaliski. PKCS #1: RSA Encryption version 1.5. RFC 2313, Internet Engineering Task Force, 1998.
12. E. Messmer. Nugache worm kicking up a Storm, January 2008. http://www.networkworld.com/news/2008/010708-nugache-worm.html.
13. J. Miller. Cheyenne teen pleads guilty to computer crime. Star-Tribune, August 2008. http://www.casperstartribune.net/articles/ 2008/08/16/news/casper/2c6fb0ecfe2ddf6c872574a700057d26.txt.
14. S. Nagaraja and R. Anderson. The topology of covert conflict. Technical Report UCAM-CL-TR-637, University of Cambridge, July 2005.
15. J. Nazario. Nugache: TCP port 8 Bot, May 2006. http://asert. arbornetworks.com/2006/05/nugache-tcp-port-8-bot/.
16. J. Paz. Fake Media Player Movie TROJ-DLOADER.IBZ, December 2006. http://blog.trendmicro.com/fake-media-player-movie-troj-dloaderibz/.
17. P. Porras, H. Saidi, and V. Yegneswaran. A Multi-perspective Analysis of the Storm (Peacomm) Worm. Technical report, Computer Science Laboratory, SRI International, 2007.
18. Y. Rekhter, B. Moskowitz, D. Karrenberg, G. J. de Groot, and E. Lear. Address allocation for private internets. RFC 1918, Internet Engineering Task Force, 1996.
19. R. Schoof and R. Koning. Detecting peer-to-peer botnets, February 2007. http://staff.science.uva.nl/-delaat/sne-2006-2007/pl7/report.pdf.
20. M. Steggink and I. Idziejcak. Detection of peer-to-peer botnets, February 2008. http://staff.science.uva.nl/-delaat/sne-2007-2008/p22/presentation.pdf.
21. S. Stover, D. Dittrieh, J. Hernandez, and S. Dietrich. Analysis of the Storm and Nugache Trojans: P2P is here. In USENIX; login: vol. 32, no. 6, December 2007.
22. The Honeynet Project. Honeynet Definitions, Requirements, and Standards version 1.6.0, 2004. http://www.honeynet.org/alliance/requirement s.html.
23. The Honeynet Project. Honeywall, 2005. http://www.honeynet.org/papers/ cdrom/.
24. Trend Micro. Taxonomy of Botnet Threats, November 2006.
25. Trend Micro. TROJ-DLOADER.IBZ, December 2006. http://www.trendmicro.com/ vinfo/virusencyclo/default5.asp?VName=TROJ/DLOADER.IBZ.
26. Trend Micro. WORM.NUGACHE.G. http://www.trendmicro.com/vinfo/ virusencyclo/default5. asp?VName=WORM\-NUGACHE.G, December 2006.
27. Trend Micro. WORM-NUGACHE.G (Japanese web site), December 2006. http://blog. trendmicro.co.jp/archives/1053.
28. United States Department of Justice. Wyoming man charged with infecting thousands of computers with 'tro-jan' that he used to commit fraud. Release No. 08-090, June 2008.
29. R. Vogt, J. Aycock, and J. Michael J. Jacobson. Army of botnets. In Proceedings of the 2007 Network and Distributed System Security Symposium (NDSS 2007), pages 111-123, February 2007.
30. P. Wang, S. Sparks, and C. C. Zou. An advanced hybrid peer-to-peer botnet. In HotBots '07: Proceedings of the first conference on First Workshop on Hot Topics in Understanding Botnets, pages 2-2, Berkeley, CA, USA, 2007. USENIX Association.