Autonomously detecting sensors in fully distributed botnets. Issue 83 (June 2019)

• Record Type: Journal Article
• Authors: Böck, Leon; Vasilomanolakis, Emmanouil; Wolf, Jan Helge; Mühlhäuser, Max
• Is Part Of: Computers & security. Issue 83(2019)
• Page Start: 1
• Page End: 13
• Publication Date: 2019-06
• Subjects: Sensor evasion -- Botnet monitoring -- Fully distributed botnets -- P2P botnets -- Computational trust; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2019.01.004
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Botnet attacks have devastating effects on public and private infrastructures. The botmasters controlling these networks aim to prevent takedown attempts by using highly resilient P2P overlays to commandeer their botnets, and even harden them with countermeasures against intelligence gathering attempts. In fact, recent research indicates that advanced countermeasures can hamper the ability to gather the necessary intelligence for taking down botnets. In this article, we take the perspective of the botmaster to eventually anticipate their behavior. That said, we present a novel mechanism, namely Trust Based Botnet Monitoring Countermeasure (TrustBotMC), that combines computational trust with specially crafted bot messages to detect the presence of monitoring activity. We study and evaluate different computational trust models, to create a local and autonomous mechanism that ensures the avoidance of common botnet tracking mechanisms, such as sensors. Furthermore, we show, via our experimental results, that our approach can reduce the gathered intelligence by at least 53% compared to techniques that have been seen in botnets to date. Finally, we investigate techniques for mitigating our approach.