AntBot: Anti-pollution peer-to-peer botnets

• Published in: Computer networks (Amsterdam, Netherlands : 1999) Vol. 55; no. 8; pp. 1941 - 1956
• Main Authors: Yan, Guanhua, Ha, Duc T., Eidenbenz, Stephan
• Format: Journal Article
• Language: English
• Published: Kidlington Elsevier B.V 01.06.2011; Elsevier; Elsevier Sequoia S.A
• Subjects: aMule; Applied sciences; Botnet; Channels; Computer security; Computer simulation; Computer viruses; Exact sciences and technology; Failure; Internet; Mathematical analysis; Methods; Miscellaneous; Network security; Operation, maintenance, reliability of teleprocessing networks; Peer to peer computing; Peer to peer networks; Peer-to-peer; Pollution; Pollution attack; Protocol; Redundancy; Searching; Spreads; Storm botnet; Strategy; Studies; Systems design; Telecommunications; Telecommunications and information theory; Teleprocessing networks. Isdn; Valuation and optimization of characteristics. Simulation; Viruses; Peer-to-peer; aMule; Pollution attack; Botnet; Storm botnet; Performance evaluation; Storm; Peer to peer; Scalability; Redundancy; Resource sharing; Tree structure; Failures; Implementation; Reachability; Resilience; Pollution; Computer network; Simulation; Simulator; Computer security; Computer attack
• ISSN: 1389-1286; 1872-7069
• DOI: 10.1016/j.comnet.2011.02.006

Botnets have emerged as one of the most severe cyber-threats in recent years. To evade detection and improve resistance against countermeasures, botnets have evolved from the first generation that relies on IRC chat channels to deliver commands to the current generation that uses highly resilient P2P (peer-to-peer) protocols to spread their C&C (Command and Control) information. On an encouraging note, the seminal work done by Holz et al. [14] showed that P2P botnets, although relieved from the single point of failure that IRC botnets suffer, can be easily disrupted using pollution-based mitigation schemes. For white-hat cyber-security practitioners to be better prepared for potentially destructive P2P botnets, it is necessary for them to understand the strategy space from the attacker’s perspective. Against this backdrop, we analyze a new type of P2P botnets, which we call AntBot, that aims to spread their C&C information to individual bots even though an adversary persistently pollutes keys used by seized bots to search the C&C information. The tree-like structure of AntBot, together with the randomness and redundancy in its design, renders it possible that individual bots, when captured, reveal only limited information. We mathematically analyze the performance of AntBot from the perspectives of reachability, resilience to pollution, and scalability. To evaluate the effectiveness of AntBot against pollution-based mitigation in a practical setting, we develop a distributed high-fidelity P2P botnet simulator that uses the actual implementation code of aMule, a popular Kademlia-based P2P client. The simulator offers us a tool to evaluate the attacker’s strategy in the cyber space without causing ethical or legal issues, which may result from real-world deployment. Using extensive simulation, we demonstrate that AntBot operates resiliently against pollution-based mitigation. We further suggest a few potential defense schemes that could effectively disrupt AntBot operations and also present challenges that researchers need to address when developing these techniques in practice.