# Modeling Peer-to-Peer Botnet on Scale-Free Network

Authors: Liping Feng; Hongbin Wang; Qi Han; Qingshan Zhao; Lipeng Song
Journal: Abstract and Applied Analysis
 (2014)

---

## Abstract

Peer-to-peer (P2P) botnets have emerged as one of the serious threats to Internet security. To prevent effectively P2P botnet, in this paper, a mathematical model which combines the scale-free trait of Internet with the formation of P2P botnet is presented. Explicit mathematical analysis demonstrates that the model has a globally stable endemic equilibrium when infection rate is greater than a critical value. Meanwhile, we find that, in scale-free network, the critical value is very little. Hence, it is unrealistic to completely dispel the P2P botnet. Numerical simulations show that one can take effective countermeasures to reduce the scale of P2P botnet or delay its outbreak. Our findings can provide meaningful instruction to network security management.


---

## Body

## 1. Introduction

A botnet is a network of thousands of compromised computers (bots) under the control of botmaster, which usually recruits new vulnerable computers by running all kinds of malicious software, such as Trojan horses, worms, and computer viruses [1]. For nefarious profits, the botnetmaster which operates a botnet manipulates remotely zombie computers to work on various malicious activities, such as distributed denial-of-service attacks (DDoS), email spam, and password cracking. Nowadays, botnets have become one of the most serious threats to Internet.According to operating mechanism of botnets, there are two kinds of botnets. One is the traditional botnet using Internet relay chat (IRC) as a form of communication for centralized command and control (C&C) structure (see Figure1 [2]). The other is peer-to-peer botnet utilizing a distributed command-and-control structure (see Figure 2 [2]). Traditional botnets are easily checked and cracked by defenders, and the threats of botnets can be mitigated and eliminated if the central of C&C is unavailable [3]. By contrast, P2P botnets employing a decentralized command-and-control structure are more robust and are much harder for security community to dismantle [4]. Therefore, P2P botnets, such as Trojan.Peacomm and Storm botnet [5], have emerged and gradually escalated in recent years. Moreover, P2P botnets are increasingly sophisticated and thus their potential damage is much greater than traditional botnets. Further, the potential for more damage exits in the future.Figure 1
Centralized botnet.Figure 2
P2P botnet.Therefore, threats of P2P botnets to Internet security have drawn widespread attention [6–12]. Yan et al. [6] mathematically analyzed the performance of Antbot—a new type of P2P botnets—from the perfectives of resilience, reachability, and scalability, and the authors developed a distributed P2P botnet simulator to evaluate the effectiveness of Antbot against pollution-based mitigation in practice. Kolesnichenko et al. [7] developed the mean-field model to analyze behaviors of P2P botnet and compared it with simulations obtained from the Mobius tool (a software tool for modeling the behavior of complex systems). Results show that the mean-field method is much faster than simulation for predicting the behavior of P2P botnet. van Ruitenbeek and Sanders [8] presented a stochastic model of Storm Worm P2P botnet to examine how different factors, such as the removal rate and the initial infection rate, impact the total propagation bots. To be well prepared for future botnet attacks, Wang et al. [9] studied advanced botnet attack techniques that could be developed by botmasters in the future and proposed the design of an advanced hybrid P2P botnet. Results show that a honeypot, in computer terminology, is a trap set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers—play an important role to defend against an advanced botnet.Nevertheless, few people studied the dynamical behaviors of P2P botnets. In [7], the authors proposed a mean-field model of P2P botnet, but the model has not been analyzed mathematically. In fact, explicit mathematical analysis contributes to understand deeply the prevalent characteristics of P2P botnet. Aiming at describing the dynamics of P2P botnets in a more effective way, in this paper, we employ the dynamical model of computer worms, which has been widely used by many researchers to study Internet malware propagation [13–22]. As many botnets are created by computer worms [23], it is reasonable to describe the prevalence of P2P botnets with the model of worm propagation. In addition, by analyzing data from real computer virus epidemics, the authors [24] pointed out the importance of incorporating the peculiar topology of scale-free network in the theoretical description of computer worm propagation. In biological epidemic areas, there is much valuable research which considers the effect of complex network on pathophoresis [25, 26]. However, we have not seen the report which considers the effect of complex network on prevalence of P2P botnet. Hence, it is necessary to examine the effect of the topology of the network on the propagation of P2P botnet.In this paper, the dynamics ofleaching P2P botnets are investigated. In aleaching P2P botnet, botmasters recruit new zombies on the Internet. For constructing this kind of P2P botnet, there are two steps: the first step is trying to infect new vulnerable hosts throughout the Internet, and the second step is newly compromised hosts joining the botnet and connecting with other bots [2]. In SF network, taking into account the heterogeneity induced by the hosts with different degree k, we divide the hosts into different states where the hosts in each state have the same degree k.


## 2. The Model

To model the propagation of the P2P botnet on the Internet, we assume that the total number of nodes on Internet is a constantN. Each node changes over time among four states: susceptible (S), exposed (E), infected (I), and recovered (R) due to the spread of computer worm. We describe these four states in detail as follows.(1)
Susceptible(S): a node has the software vulnerability that the bot program can exploit.(2)
Exposed(E): a node has been infected by the bot program, but it has not become a member of P2P botnet.(3)
Infected(I): a node is a formal member of P2P botnet, which means the node can infect its neighbors with the bot program.(4)
Removed(R): a node has installed a detection tool that can identify and remove the bot program, or a node has installed a software patch to eliminate the node vulnerability exploited by the bot program.There are five state transitions among these four states.(1)
Propagating the bot program: nodes in the “susceptible” state will change to the “exposed” state with the infection rateβ.(2)
Joining the P2P botnet from exposed state: nodes in the “exposed” state will join the P2P botnet under the control of the botmaster and change to “infected” state at the proportionδ.(3)
Immunizing nodes from susceptible state: nodes in the “susceptible” state will change to the “recovered” state at the proportionrs if corresponding nodes take countermeasures, for example, antivirus software, patching, firewall, and intrusion detection system (IDS). The immune rate is affected by many factors, for example, user vigilance.(4)
Immunizing nodes from exposed state: nodes in the “exposed” state will change to the “recovered” state at the proportionr1 if corresponding nodes take antivirus countermeasures.(5)
Immunizing nodes from infected state: nodes in the “infected” state will change to the “recovered” state at the proportionr2 if corresponding nodes take antivirus countermeasures.LetSk(t), Ek(t), Ik(t), and Rk(t) be the number of degree k in states S, E, I, and R at time t, respectively. Then one has
(1)Sk(t)+Ek(t)+Ik(t)+Rk(t)=N.
The dynamic equations can be written as
(2)dSk(t)dt=μ-αkθ(I(t))Sk(t)-(μ+rs)Sk(t),dEk(t)dt=αkθ(I(t))Sk(t)-(μ+r1+δ)Ek(t),dIk(t)dt=δEk(t)-(μ+r2)Ik(t),dRk(t)dt=rsSk(t)+r1Ek(t)+r2Ik(t)-μRk(t),
where the probability 0≤θ(I(t))≤1 describes a link pointing to an infected host, which satisfies the relation
(3)θ(I(t))=1〈k〉∑kkP(k)Ik(t),
and I(t)=∑kP(k)Ik is the density of infected hosts in the whole network at time t; P(k) is a degree distribution. Other parameters can be explained as follows. μ is the replacement rate of the hosts per hour; α is infection rate per hour; rs is the state transition rate from Sk to Rk due to immune measures; ri(i=1,2) is the recovery rate from exposed state Ek and infected state Ik, respectively; and δ is transition rate from Ek to Ik.


## 3. Model Analysis

In this subsection, we solve the equilibria of system (2) and investigate their stability.The first three equations in system (2) do not depend on the fourth equation, and, therefore, this equation may be omitted without loss of generality. Hence, system (2) can be rewritten as
(4)dSk(t)dt=μ-αkθ(I(t))Sk(t)-(μ+rs)Sk(t),dEk(t)dt=αkθ(I(t))Sk(t)-(μ+r1+δ)Ek(t),dIk(t)dt=δEk(t)-(μ+r2)Ik(t).
The equilibria of system (7) are determined by setting
(5)μ-αkθ(I(t))Sk(t)-(μ+rs)Sk(t)=0,αkθ(I(t))Sk(t)-(μ+r1+δ)Ek(t)=0,δEk(t)-(μ+r2)Ik(t)=0.There is always a disease-free equilibrium (DFE)Q0=(μ/(μ+rs),0,0). Furthermore, solving the endemic equilibrium of (5), one can obtain Q1=(Sk*,Ek*,Ik*), where
(6)Sk*=μαkθ+μ+rs,Ek*=μαkθ(αkθ+μ+rs)(μ+r1+δ),Ik*=δμαkθ(αkθ+μ+rs)(μ+r1+δ)(μ+r2).
Substituting Ik* into (3), we have
(7)θ=1〈k〉∑kkP(k)Ik(t)=1〈k〉∑kkP(k)δμαkθ(αkθ+μ+rs)(μ+r1+δ)(μ+r2).
Obviously, if the endemic equilibrium exists, there must be 0<θ≤1. That is, it must satisfy
(8)ddθ[1〈k〉∑kkP(k)δμαkθ(αkθ+μ+rs)(μ+r1+δ)(μ+r2)]|θ=0≥1,
and it equals
(9)1〈k〉∑kkP(k){((αkθ+μ+rs)(μ+r1+δ)(μ+r2))-1(k2δμαk(μ+r1+δ)(μ+r2)(αkθ+μ+rs)kkkkkkkkkkk-(μ+r1+δ)(μ+r2)δμα2k2θ)kkkkkkkkkkk×((αkθ+μ+rs)(μ+r1+δ)(μ+r2))-1}|θ=0≥1.
Let αc be the minimum value of α satisfying the above inequality. Then,
(10)δμαc〈k〉(μ+rs)(μ+r1+δ)(μ+r2)∑kk2P(k)=1;
that is
(11)〈k2〉δμαc〈k〉(μ+rs)(μ+r1+δ)(μ+r2)=1,
where 〈k2〉=∑kk2P(k).Hence,(12)αc=〈k〉(μ+rs)(μ+r1+δ)(μ+r2)〈k2〉δμ.
Summarizing the above analysis, one can get the following theorem.Theorem 1.
Ifα<αc, then system (4) has only one free-equilibrium Q0; if α>αc, then system (4) has endemic-equilibrium Q* except Q0.
In what follows, the endemic-equilibrium pointQ* will be analyzed.
The Jacobian matrix of system (4) at Q* is
(13)J=(-αk1〈k〉∑kkP(k)Ik*0αkSk*1〈k〉∑kkP(k)αk1〈k〉∑kkP(k)Ik*-(μ+γ1+δ)αkSk*1〈k〉∑kkP(k)0δ-(μ+γ2)),
and the associated characteristic equation is
(14)λ3+aλ2+bλ+c=0,
where
(15)a=μ+r1+δ+μ+r2+αk1〈k〉∑kkP(k)Ik*,b=(μ+r1+δ)(μ+r2)-δαkSk*1〈k〉∑kkP(k)+(αk1〈k〉∑kkP(k)Ik*+μ+rs)(r1+δ+2μ+r2),c=(αk1〈k〉∑kkP(k)Ik*+μ+rs)(μ+r1+δ)(μ+r2)-(δαkSk*1〈k〉∑kkP(k))×(αk1〈k〉∑kkP(k)Ik*+μ+rs+αk1〈k〉∑kkP(k)).
According to Hurwitz criteria [27],
(16)H1=μ+r1+δ+μ+r2+αk1〈k〉∑kkP(k)Ik*>0,H2=H1b-c,H3=H2c.
Hence, one can obtain the following lemmas.Lemma 2.
For system (4), if H2>0 and H3>0 hold, then the endemic-equilibrium Q* is locally asymptotically stable.
For depicting the globally asymptotical stability ofQ*, firstly, one can introduce three preliminary results.Lemma 3 (see [28, 29]).
Suppose that the initial relative infected density0<Ik(0)<1 satisfies ∑kkP(k)Ik(0)>0. Then, for all t>0, the solution of system (4) satisfies 0<θ(I(t))<1 and 0<Ik(t)<1.Proposition 4 (see [28, 29]).
Suppose that the solutionIk(t) of system (4) satisfies limsupt→∞Ik≤Uk and liminft→∞Ik≥ℓk, where Uk≥0 and ℓk≥0. Then,
(17)lim⁡t→∞sup⁡Ik≤(αδμk1〈k〉∑kkP(k)Uk)×((μ+rs+αk1〈k〉∑kkP(k)Uk)(μ+r1+δ)(μ+r2)kkkkkk×(μ+rs+αk1〈k〉∑kkP(k)Uk))-1,lim⁡t→∞inf⁡Ik≥(αδμk1〈k〉∑kkP(k)ℓk)×((μ+rs+αk1〈k〉∑kkP(k)ℓk)(μ+r1+δ)(μ+r2)kkkkkk×(μ+rs+αk1〈k〉∑kkP(k)Uk))-1.Proposition 5 (see [28, 29]).
Suppose that the initial relative infected densities0<Ik(0)<1 satisfy α>αc and ∑kkP(k)Ik(0)>0. Then, the solution of system (4) satisfies lim⁡t→∞inf⁡θ(I(t))>0 and lim⁡t→∞inf⁡Ik(t)>0.The proofs of the above conclusions are similar to those presented in [28, 29]. Here, we will omit them.Next, main results will be presented.Lemma 6.
Suppose that the initial relative infected densities0<Ik(0)<1 satisfy α>αc and ∑kkP(k)Ik(0)>0. Then, the solution of system (4) satisfies lim⁡t→∞Ik(t)=Ik, lim⁡t→∞Ek(t)=Ek, and lim⁡t→∞Sk(t)=Sk, where I1,I2,I3,…,In(E1,E2,E3,…,En;S1,S2,S3,…,Sn) are the unique nonzero stationary points of system (4).
The proof is completed in the appendixCombining Lemma2 with Lemma 6, one can conclude the following conclusion.Theorem 7.
If the endemic-equilibriumQ* exists, then it is globally asymptotically stable.


## 4. Numerical Analysis and Control Strategies

### 4.1. Numerical Examples

In this subsection we present the results of numerical experiments investigating the effectiveness of theoretic analysis. In order to observe the effects of parameters on transmission process, we use system (4) to simulate the evolution behavior of P2P botnet for given parameters on SF network with 〈k〉=8 and N=100000. Here, we set the parameter values of system (4) which are, respectively, μ=0.01, rs=0.01, r1=0.06, r2=0.06, and δ=0.6. By calculation, one can obtain αc=1.49×10-5. Figures 3 and 4 show the simulation results with α=0.005>αc and α=1.5×10-6<αc, respectively, which are consistent with theoretical analysis.Figure 3
The density of infected nodes with parametersμ=0.01, rs=0.01, r1=0.06, r2=0.06, α=0.005>αc, 〈k〉=8, and N=100000.Figure 4
The density of infected nodes with parametersμ=0.01, rs=0.01, r1=0.06, r2=0.06, α=1.5×10-8<αc, 〈k〉=8, and N=100000.From the conclusion of Theorem7, we learn that it is necessary for eliminating P2P botnet on the Internet to let α<αc by corresponding countermeasures. Meanwhile, the simulation results show that the critical value of infection αc is very little, and this means that it is difficult to destroy completely the P2P botnet in reality.


### 4.2. Control Strategies

In what follows, we consider mainly the effect of the real-time immune measurement and antivirus software on the scale of the P2P botnet.(i)
For fixed model parameters,μ=0.01, r1=0.06, r2=0.06, δ=0.6, and α=0.005, we investigate the effect of different real-time immunity (rs) on the scale of P2P botnet. Simulation result is depicted in Figure 5. From Figure 5, it can be observed that enhancing real-time immune measures contributes to reduce the scale of P2P botnet and delay its outbreak. Hence, it is strongly advised that network users should install patches for bugs in time and update antivirus software to the latest version.(ii)
For fixed model parameters,μ=0.01, r1=0.06, r2=0.06, rs=0.01, and α=0.005, we investigate the effect of antivirus software (δ) on the scale of P2P botnet. Simulation results are depicted in Figure 6. The profile of Figure 6 demonstrates that the larger percent conversion from E to I there is, the bigger scale a P2P botnet has. Thus, it is proposed that malware is killed when the node is infected by the bot program but does not join botnet.Figure 5
An illustration of the impact of real-time immune measure (rs) on the density of infected nodes.Figure 6
An illustration of the impact of antivirus software (δ) on the density of infected nodes.Additionally, the effect of average degree〈k〉 on prevalent behavior of P2P botnet is depicted in Figure 7. From Figure 7, we find that the scale of P2P botnet will increase when 〈k〉 becomes larger. So decreasing the average degree of network can also control the massive outbreak of P2P botnet.Figure 7
An illustration of the impact of average degree(〈k〉) on the density of infected nodes.


## 4.1. Numerical Examples

In this subsection we present the results of numerical experiments investigating the effectiveness of theoretic analysis. In order to observe the effects of parameters on transmission process, we use system (4) to simulate the evolution behavior of P2P botnet for given parameters on SF network with 〈k〉=8 and N=100000. Here, we set the parameter values of system (4) which are, respectively, μ=0.01, rs=0.01, r1=0.06, r2=0.06, and δ=0.6. By calculation, one can obtain αc=1.49×10-5. Figures 3 and 4 show the simulation results with α=0.005>αc and α=1.5×10-6<αc, respectively, which are consistent with theoretical analysis.Figure 3
The density of infected nodes with parametersμ=0.01, rs=0.01, r1=0.06, r2=0.06, α=0.005>αc, 〈k〉=8, and N=100000.Figure 4
The density of infected nodes with parametersμ=0.01, rs=0.01, r1=0.06, r2=0.06, α=1.5×10-8<αc, 〈k〉=8, and N=100000.From the conclusion of Theorem7, we learn that it is necessary for eliminating P2P botnet on the Internet to let α<αc by corresponding countermeasures. Meanwhile, the simulation results show that the critical value of infection αc is very little, and this means that it is difficult to destroy completely the P2P botnet in reality.


## 4.2. Control Strategies

In what follows, we consider mainly the effect of the real-time immune measurement and antivirus software on the scale of the P2P botnet.(i)
For fixed model parameters,μ=0.01, r1=0.06, r2=0.06, δ=0.6, and α=0.005, we investigate the effect of different real-time immunity (rs) on the scale of P2P botnet. Simulation result is depicted in Figure 5. From Figure 5, it can be observed that enhancing real-time immune measures contributes to reduce the scale of P2P botnet and delay its outbreak. Hence, it is strongly advised that network users should install patches for bugs in time and update antivirus software to the latest version.(ii)
For fixed model parameters,μ=0.01, r1=0.06, r2=0.06, rs=0.01, and α=0.005, we investigate the effect of antivirus software (δ) on the scale of P2P botnet. Simulation results are depicted in Figure 6. The profile of Figure 6 demonstrates that the larger percent conversion from E to I there is, the bigger scale a P2P botnet has. Thus, it is proposed that malware is killed when the node is infected by the bot program but does not join botnet.Figure 5
An illustration of the impact of real-time immune measure (rs) on the density of infected nodes.Figure 6
An illustration of the impact of antivirus software (δ) on the density of infected nodes.Additionally, the effect of average degree〈k〉 on prevalent behavior of P2P botnet is depicted in Figure 7. From Figure 7, we find that the scale of P2P botnet will increase when 〈k〉 becomes larger. So decreasing the average degree of network can also control the massive outbreak of P2P botnet.Figure 7
An illustration of the impact of average degree(〈k〉) on the density of infected nodes.


## 5. Conclusions

As a new kind of attack platform to network security, P2P botnets have attracted considerable attention. Research is necessary to fully understand the threat and prepare to defend against it. To better exploit the spreading behavior of P2P botnet, in this paper, we present a mathematical model of creation of P2P botnet, which combines the scale-free character of Internet with the formation trait of P2P botnet. Hence, the model can portrait more accurately the dynamical features of P2P botnet propagation. Theoretical analysis shows that the model has a globally stable endemic equilibrium. The influence of some parameters to the scale of P2P botnet has been investigated. Simulation results demonstrate that it is difficult to destroy completely the P2P botnet in reality. This is the reason that many malwares saturate to a very low level of persistence [30]. However, Figures 6 and 7 show that we can reduce the scale of P2P botnet and delay its outbreak by efficient countermeasures, such as real-time immunity or autorunning of antivirus software.The dynamical model we present could be extended to study the growth possibilities of P2P botnets in future work. The model is also possible to predict how botnetmasters could create more potent and aggressive botnets. Such predictions could ultimately be useful to antimalware developers as well.



---

*Source: 212478-2014-04-23.xml*