Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm
نویسندگان
چکیده
Botnets, i.e., networks of compromised machines under a common control infrastructure, are commonly controlled by an attacker with the help of a central server: all compromised machines connect to the central server and wait for commands. However, the first botnets that use peer-to-peer (P2P) networks for remote control of the compromised machines appeared in the wild recently. In this paper, we introduce a methodology to analyze and mitigate P2P botnets. In a case study, we examine in detail the Storm Worm botnet, the most wide-spread P2P botnet currently propagating in the wild. We were able to infiltrate and analyze in-depth the botnet, which allows us to estimate the total number of compromised machines. Furthermore, we present two different ways to disrupt the communication channel between controller and compromised machines in order to mitigate the botnet and evaluate the effectiveness of these mechanisms.
منابع مشابه
Peer-to-Peer Botnets
“Botnet” is a network of computers that are compromised and controlled by an attacker. Botnets are one of the most serious threats to today’s Internet. Most current botnets have centralized command and control (C&C) architecture. However, peer-to-peer (P2P) structured botnets have gradually emerged as a new advanced form of botnets. Without C&C servers, P2P botnets are more resilient to defense...
متن کاملPeer-to-Peer Botnets: The Next Generation of Botnet Attacks
“Botnet” is a network of computers that are compromised and controlled by an attacker. Botnets are one of the most serious threats to today’s Internet. Most current botnets have centralized command and control (C&C) architecture. However, peer-to-peer (P2P) structured botnets have gradually emerged as a new advanced form of botnets. Without C&C servers, P2P botnets are more resilient to defense...
متن کاملComparison of the Mean-Field Approach and Simulation in a Peer-to-Peer Botnet Case Study
Peer-to-peer botnets, as exemplified by the Storm Worm and Stuxnet, are a relatively new threat to security on the internet: infected computers automatically search for other computers to be infected, thus spreading the infection rapidly. In a recent paper, such botnets have been modeled using Stochastic Activity Networks, allowing the use of discreteevent simulation to judge strategies for com...
متن کاملP2PWNED: Modeling and Evaluating the Resilience of Peer-to-Peer Botnets
Centralized botnets are easy targets for takedown efforts by computer security researchers and law enforcement. Thus, botnet controllers have sought new ways to harden the infrastructures of their botnets. In order to meet this objective, some botnet operators have (re)designed their botnets to use Peer-to-Peer (P2P) infrastructures. Many P2P botnets are far more resilient to takedown attempts ...
متن کاملInternet Epidemics: Attacks, Detection and Defenses, and Trends
Internet epidemics are malicious software that can self-propagate across the Internet, i.e., compromise vulnerable hosts and use them to attack other victims. Since the early stage of the Internet, epidemics have caused enormous damages and been a significant security threat. For example, the Morris worm infected 10% of all hosts in the Internet in 1988; the Code Red worm compromised at least 3...
متن کامل