An advanced hybrid peer-to-peer botnet

IEEE Transactions on Dependable and Secure Computing

Volumn 7, Issue 2, 2010, Pages 113-127

  Wang, Ping ^a   Sparks, Sherri ^a   Zou, Cliff C ^a  

^a University of Central Florida   (United States)

Author keywords

Honeypot; Peer to peer; Robustness; Terms Botnet

Indexed keywords

BOTNETS; CONTROL TRAFFIC; HONEYPOTS; INTERNET ATTACKS; PEER TO PEER; ROBUST NETWORK; ROOT CAUSE; SHUT DOWN;

COMPUTER CONTROL SYSTEMS; CRYPTOGRAPHY;

DESIGN;

EID: 77952687808     PISSN: 15455971     EISSN: None     Source Type: Journal    
DOI: 10.1109/TDSC.2008.35     Document Type: Article

References (45)

1. S. Kandula, D. Katabi, M. Jacob, and A. Berger, "Botz-4-Sale: Surviving Organized DDOS Attacks That Mimic Flash Crowds," Proc. Second Symp. Networked Systems Design and Implementation (NSDI '05), May 2005.
2. C. T. News, Expert: Botnets No. 1 Emerging Internet Threat, http://www.cnn.com/2006/TECH/internet/01/31/furst/, 2006.
3. F. Freiling, T. Holz, and G. Wicherski, "Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of- Service Attacks," Technical Report AIB-2005-07, CS Dept. RWTH Aachen Univ., Apr. 2005.
4. D. Dagon, C. Zou, and W. Lee, "Modeling Botnet Propagation Using Time Zones," Proc. 13th Ann. Network and Distributed System Security Symp. (NDSS '06), pp. 235-249, Feb. 2006.
5. A. Ramachandran, N. Feamster, and D. Dagon, "Revealing Botnet Membership Using DNSBL Counter-Intelligence," Proc. USENIX Second Workshop Steps to Reducing Unwanted Traffic on the Internet (SRUTI '06), June 2006.
6. E. Cooke, F. Jahanian, and D. McPherson, "The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets," Proc. USE-NIX Workshop Steps to Reducing Unwanted Traffic on the Internet (SRUTI '05), July 2005.
7. J. R. Binkley and S. Singh, "An Algorithm for Anomaly-Based Botnet Detection," Proc. USENIX Second Workshop Steps to Reducing Unwanted Traffic on the Internet (SRUTI '06), June 2006.
8. I. Arce and E. Levy, "An Analysis of the Slapper Worm," IEEE Security & Privacy Magazine, vol. 1, no. 1, pp. 82-87, Jan.-Feb. 2003.
9. Sinit P2P Trojan Analysis, http://www.lurhq.com/sinit.html, 2008.
10. Phatbot Trojan Analysis, http://www.lurhq.com/phatbot.html, 2008.
11. R. Lemos, Bot Software Looks to Improve Peerage, http://www. securityfocus.com/news/11390, May 2006.
12. Servent, http://en. wikipedia.org/wiki/Servent, 2008.
13. R. Puri, Bots & Botnet: An Overview, http://www.sans.org/rr/ whitepapers/malicious/1299.php, 2003.
14. B. McCarty, "Botnets: Big and Bigger," IEEE Security & Privacy Magazine, vol. 1, no. 4, pp. 87-90, July-Aug. 2003.
15. P. Barford and V. Yegneswaran, An Inside Look at Botnets, to appear in Series: Advances in Information Security. Springer, 2006.
16. H. Project, Know Your Enemy: Tracking Botnets, http://www.honeynet.org/ papers/bots/, 2005.
17. F. Monrose, "Longitudinal Analysis of Botnet Dynamics," ARO/DARPA/DHS Special Workshop Botnet, 2006.
18. T. Strayer, "Detecting Botnets with Tight Command and Control," ARO/DARPA/DHS Special Workshop Botnet, 2006.
19. Y. Chen, "IRC-Based Botnet Detection on High-Speed Routers," ARO/DARPA/DHS Special Workshop Botnet, 2006.
20. C. Zou and R. Cunningham, "Honeypot-Aware Advanced Botnet Construction and Maintenance," Proc. Int'l Conf. Dependable Systems and Networks (DSN '06), June 2006.
21. R. Vogt, J. Aycock, and M. Jacobson, "Army of Botnets," Proc. 14th Ann. Network and Distributed System Security Symp. (NDSS '07), Feb. 2007.
22. E. K. Lua, J. Crowcroft, M. Pias, R. Sharma, and S. Lim, "A Survey and Comparison of Peer-to-Peer Overlay Network Schemes," IEEE Comm. Surveys and Tutorials, vol. 7, no. 2, 2005.
23. N. Provos, "A Virtual Honeypot Framework," Proc. 13th Conf. USENIX Security Symp. (SSYM '04), Aug. 2004.
24. R. Bhagwan, S. Savage, and G. M. Voelker, "Understanding Availability," Proc. Second Int'l Workshop Peer-to-Peer Systems (IPTPS '03), Feb. 2003.
25. A. Ramachandran and N. Feamster, "Understanding the Network-Level Behavior of Spammers," Proc. ACM SIGCOMM '06, Sept. 2006.
26. C. Gkantsidis, T. Karagiannis, P. Rodriguez, and M. Vojnovic, "Planet Scale Software Updates," Proc. ACM SIGCOMM '06, Sept. 2006.
27. CNET News: Bots Slim Down to Get Tough, http://news.com.com/2104-7355-3- 5956143.html, Nov. 2005.
28. Washington Post: The Botnet Trackers, http://www.washington post.com/wp-dyn/content/article/2006/02/16 AR2006021601388.html, Feb. 2006.
29. D. Nicol and M. Liljenstam, "Models of Active Worm Defenses," Proc. IPSI Studenica Conf., June 2004.
30. M. Liljenstam and D. Nicol, "Comparing Passive and Active Worm Defenses," Proc. First Int'l Conf. Quantitative Evaluation of Systems (QEST '04), Sept. 2004.
31. V. A. Skormin, J. G. Delgado-Frias, D. L. McGee, J. Giordano, L. J. Popyack, V. I. Gorodetski, and A. O. Tarakanov, "BASIS: A Biological Approach to System Information Security," Proc. Int'l Workshop Information Assurance in Computer Networks (MMM-ACNS '01), pp. 127-142, 2001.
32. M. Rajab, J. Zarfoss, F. Monrose, and A. Terzis, "A Multifaceted Approach to Understanding the Botnet Phenomenon," Proc. ACM SIGCOMM Internet Measurement Conf. (IMC '06), Oct. 2006.
33. D. Dagon, X. Qin, G. Gu, W. Lee, J. Grizzard, J. Levin, and H. Owen, "Honeystat: Local Worm Detection Using Honeypots," Proc. Seventh Int'l Symp. Recent Advances in Intrusion Detection (RAID), 2004.
34. Y. Tang and S. Chen, "Defending Against Internet Worms: A Signature-Based Approach," Proc. IEEE INFOCOM '05, May 2005.
35. Y. Chen, R. Venkatesan, M. Cary, R. Pang, S. Sinha, and M. H. Jakubowski, "Oblivious Hashing: A Stealthy Software Integrity Verification Primitive," Revised Papers from the Fifth Int'l Workshop Information Hiding (IH '03), pp. 400-414, 2003.
36. J. R. Douceur, "The Sybil Attack," Revised Papers from the First Int'l Workshop Peer-to-Peer Systems (IPTPS '02), pp. 251-260, 2002.
37. C. Zou, L. Gao, W. Gong, and D. Towsley, "Monitoring and Early Warning for Internet Worms," Proc. 10th ACM Conf. Computer and Comm. Security (CCS '03), pp. 190-199, Oct. 2003.
38. S. Staniford, V. Paxson, and N. Weaver, "How to Own the Internet in Your Spare Time," Proc. 11th USENIX Security Symp. (SSYM '02), pp. 149-167, Aug. 2002.
39. D. Moore, C. Shannon, G. Voelker, and S. Savage, "Network Telescopes: Technical Report," Technical Report TR-2004-04, CAIDA, 2004.
40. Honeyd Security Advisory 2004-001: Remote Detection via Simple Probe Packet, http://www.honeyd.org/adv. 2004-01.asc, 2004.
41. University of Michigan Internet Motion Sensor, http://ims.eecs.umich.edu/ , 2008.
42. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee, "BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation," Proc. 16th USENIX Security Symp. (Security '07), Aug. 2007.
43. Wikipedia: Binomial Distribution, http://en. wikipedia.org/wiki/Binomial- distribution, 2008.
44. K. Seifried, Honeypotting with VMware Basics, http://www.seifried.org/ security/index.php/Honeypotting-With-VMWare-Basics, 2002.
45. J. Corey, Advanced Honey Pot Identification and Exploitation, http://www.phrack.org/fakes/p63/p63-0x09.txt, 2004.