Bots are coordinated by a command and control (C&C) infrastructure to launch attacks that seriously threaten the Internet services and users. Most botnet-detection ap proaches function at the network level and require the anal ysis of packets' payloads, raising privacy concerns and in curring large computational overheads. Moreover, network traffic analysis alone can seldom provide a complete pic ture of botnets' behavior. By contrast, in-host detection approaches are useful to identify each bot's host-wide be havior, but are susceptible to the host-resident malware if used alone. To address these limitations, we consider both the coordination within a botnet and the malicious behav ior each bot exhibits at the host level, and propose a C&C protocol-independent detection framework that combines host-and network-level information for making detection decisions. The framework is shown to be effective in detect ing various types of botnets with low false-alarm rates. Botnets have now become one of the most serious secu rity threats to Internet services and applications. A bot is a computer compromised by worms, Trojan horses, or back doors, under a remote command and control (C&C) infras tructure. A group of coordinated bots is called a botnet, and can cooperatively mount Distributed-Denial-of-Service (DDoS) attacks, spamming, phishing, identity theft, and other cyber crimes. To control a botnet, a botmaster needs to use a C&C channel to issue commands, and coordinate bots' actions. Traditional botnets utilize the IRC protocol as their C&C infrastructure. Attackers set up an IRC server and specify a channel via which bots connect to, and listen on, in order to receive commands from botmasters. HTTP based botnets are similar to the IRC-based ones, but after in fection, bots contact a web-based C&C server and notify the server with their system-identifying information via HTTP. This server sends back commands via HTTP responses. Al though IRC-and HTTP-based C&C have been adopted by many past and current botnets, both of them are vulnerable to a central-point-of-failure. That is, once the central IRC or HTTP server is identified and removed, the entire botnet 978-1-4244-7501-8/10/$26.00 ©201O IEEE will be disabled. To counter this weakness, attackers have recently shifted toward a new generation of botnets utilizing decentralized C&C protocols such as P2P. This C&C infrastructure makes detection and mitigation much harder. A well-known exam ple is the Storm worm [4] which spreads via email spam and is known to be the first malware to seed a botnet in a hybrid P2P fashion. Storm uses peers as HTTP proxies to relay C&C traffic and hides the botmasters well behind the P2P network. A recent spambot Waledac, which came to the wild at the end of 2008, also spreads via spam emails and forms its botnet using a C&C structure similar to the Storm botnet. Some researchers pointed out that Waledac is the new and improved version of the Storm botnet [18] . To date, most botnet-detection approaches operate at the network level; a majority of them target traditional IRC-or HTTP-based botnets [12, 5, 10, 14, 17, 22] by looking for traffic signatures or flow patterns. We are aware of only one approach [11] designed for protocol-and structure-independent botnet detection. This approach re quires packet-level inspection and depends solely on net work traffic analysis, unlikely to have a complete view of botnets' behavior. We thus need the finer-grained host-by host behavior inspection to complement the network anal ysis. On the other hand, since bots behave maliciously system-wide, general host-based detection can be useful. One such way is to match mal ware signatures, but it is ef fective in detecting known bots only. To deal with unknown bot infiltration, in-host behavior analysis [6, 15, 8, 21, 20 ] is needed. However, since some in-host malicious behavior is not exclusive to bots and in-host mechanisms are vulnerable to host-resident malware, host-based approaches alone can hardly provide reliable detection results and thus we need external, hard-to-compromise (i.e., network-level) informa tion for more accurate detection of bots' malicious behavior. Considering the required coordination within each bot net at the network level and the malicious behavior each bot exhibits at the host level, we propose a C&C protocol independent detection framework that incorporates infor mation collected at both the host and the network levels. The two sources of information complement each other in making detection decisions. Our framework first identifies suspicious hosts by discovering similar behaviors among 291 DSN 2010: Zeng et al.
Zeng et al. REF also proposed to detect bots combining information from both host and network levels.
Detection of botnets using combined host- and network-level information
2010 IEEE/IFIP International Conference on Dependable Systems & Networks (DSN)
2010 IEEE/IFIP International Conference on Dependable Systems & Networks (DSN)
Computer Science