Reconstruction of C&C Channel for P2P Botnet
This addresses the challenge of botnet detection and disruption for cybersecurity practitioners, though it appears incremental as it builds on existing graph reconstruction methods with a probabilistic approach.
The paper tackles the problem of reconstructing command-and-control (C&C) channel topologies for P2P botnets, which are hard to detect due to their robustness and geographic dispersion. The proposed probabilistic method achieves over 90% accuracy in edge estimation for a 1000-member network using 22 cascades of inaccurate receiving times.
Breaking down botnets have always been a big challenge. The robustness of C&C channels is increased, and the detection of botmaster is harder in P2P botnets. In this paper, we propose a probabilistic method to reconstruct the topologies of the C&C channel for P2P botnets. Due to the geographic dispersion of P2P botnet members, it is not possible to supervise all members, and there does not exist all necessary data for applying other graph reconstruction methods. So far, no general method has been introduced to reconstruct C&C channel topology for all type of P2P botnet. In our method, the probability of connections between bots is estimated by using the inaccurate receiving times of several cascades, network model parameters of C&C channel, and end-to-end delay distribution of the Internet. The receiving times can be collected by observing the external reaction of bots to commands. The results of our simulations show that more than 90% of the edges in a 1000-member network with node degree mean 50, have been accurately estimated by collecting the inaccurate receiving times of 22 cascades. In case the receiving times of just half of the bots are collected, this accuracy of estimation is obtained by using 95 cascades.