Towards complete node enumeration in a peer-to-peer botnet

Brent Byunghoon Kang, Eric Chan-Tin, Christopher P. Lee, James Tyra, Hun Jeong Kang, Chris Nunnery, Zachariah Wadler, Greg Sinclair, Nick Hopper, David Dagon, Yongdae Kim

Research output: Chapter in Book/Report/Conference proceedingConference contribution

38 Scopus citations

Abstract

Modern advanced botnets may employ a decentralized peer-to-peer overlay network to bootstrap and maintain their command and control channels, making them more resilient to traditional mitigation efforts such as server incapacitation. As an alternative strategy, the malware defense community has been trying to identify the bot-infected hosts and enumerate the IP addresses of the participating nodes so that the list can be used by system administrators to identify local infections, block spam emails sent from bots, and configure firewalls to protect local users. Enumerating the infected hosts, however, has presented challenges. One cannot identify infected hosts behind firewalls or NAT devices by employing crawlers, a commonly used enumeration technique where recursive get-peerlist lookup requests are sent newly discovered IP addresses of infected hosts. As many bot-infected machines in homes or offices are behind firewall or NAT devices, these crawler-based enumeration methods would miss a large portions of botnet infections. In this paper, we present the Passive P2P Monitor (PPM), which can enumerate the infected hosts regardless whether or not they are behind a firewall or NAT. As an empirical study, we examined the Storm botnet and enumerated its infected hosts using the PPM. We also improve our PPM design by incorporating a FireWall Checker (FWC) to identify nodes behind a firewall. Our experiment with the peer-to-peer Storm botnet shows that more than 40% of bots that contact the PPM are behind firewall or NAT devices, implying that crawler-based enumeration techniques would miss out a significant portion of the botnet population. Finally, we show that the PPM's coverage is based on a probability-based coverage model that we derived from the empirical observation of the Storm botnet.

Original languageEnglish (US)
Title of host publicationProceedings of the 4th International Symposium on ACM Symposium on Information, Computer and Communications Security, ASIACCS'09
Pages23-34
Number of pages12
DOIs
StatePublished - 2009
Event4th International Symposium on ACM Symposium on Information, Computer and Communications Security, ASIACCS'09 - Sydney, NSW, Australia
Duration: Mar 10 2009Mar 12 2009

Publication series

NameProceedings of the 4th International Symposium on ACM Symposium on Information, Computer and Communications Security, ASIACCS'09

Other

Other4th International Symposium on ACM Symposium on Information, Computer and Communications Security, ASIACCS'09
CountryAustralia
CitySydney, NSW
Period3/10/093/12/09

Keywords

  • Botnet
  • Infected hosts enumeration
  • P2P
  • Storm

Fingerprint Dive into the research topics of 'Towards complete node enumeration in a peer-to-peer botnet'. Together they form a unique fingerprint.

Cite this