A Comparative Analysis of the Resilience of Peer–to–Peer Botnets

Botnets have traditionally used centralized architectures for command and control. In such architectures, a relatively small number of centralized servers is used to command the bots. Centralized botnet architectures are straightforward to deploy, but relatively easy to take down by disabling the command and control servers. In an effort to increase the resilience of their botnets, malware creators have begun to implement peer–to–peer command and control architectures. In peer–to–peer botnets, rather than relying on centralized command servers, bots cooperate to spread commands amongst themselves. This lack of centralized command and control servers potentially makes peer–to–peer botnets very difficult to disable, but the exact degree of resilience greatly varies depending on the communication model and architecture of each botnet. In this thesis, we analyze and compare the resilience of the major peer–to–peer botnet threats to date. Additionally, we present the results of our reverse engineering analysis and takedown attempt against Zeus, a novel and previously undocumented peer–to–peer botnet.