Identifying and Characterizing Bashlite and Mirai C&C Servers IoT devices are often a vector for assembling massive botnets, as a consequence of being broadly available, having limited security protections, and significant challenges in deploying software upgrades. Such botnets are usually controlled by centralized CommandandControl (Cu0026C) servers, which need to be identified and taken down to mitigate threats. In this paper we propose a framework to infer Cu0026C server IP addresses using four heuristics. Our heuristics employ static and dynamic analysis to automatically extract information from malware binaries. We use active measurements to validate inferences, and demonstrate the efficacy of our framework by identifying and characterizing Cu0026C servers for 62% of 1050 malware binaries collected using 47 honeypots.

A New C&C Channel Detection Framework Using Heuristic Rule and Transfer Learning A great many of botnet detection methods focus on recognizing the significant Cu0026C channels. Most of them require a Cu0026C training set to build a behavior detection model. However, when lacking such training set for new or unknown botnets, these methods may become inefficient or even invalid.To overcome it, we propose a new general framework for Cu0026C channel detection. It neither needs us to know the families of bots or prepare a training set nor requires deploying malicious activity monitors. Also, it is capable of mining useful knowledge from the historical dataset to boost its detection performance. In our framework, we put forward a clustering method and several heuristic rules to aggregate and label partial Cu0026C traffic, a sample selection function to mine useful historical knowledge and a transfer learning based model to find other Cu0026C channels. We evaluated our framework on two datasets and achieved the best Cu0026C Fmeasure of about 0.886 and 0.960 respectively. Moreover, the comparison result further indicates its performance advantage and better behavior learning ability.