Botnet Architecture

MODELING BOTNET IN PEER TO PEER SYSTEMS

PRESENTED BY

J.P.Bhagath Singh B.E,M.TECH(N/W)VIT UNIVERSITY

VELLORE

&

GUIDEDBY

Prof.Chandra Mouliswaran.S

INTRODUCTION

In the last several years, Internet malware attacks have evolved into better-organized and more profit-centered endeavors.

E-mail spam, extortion through denial-of-service attacks, and click fraud represent a few examples of this emerging trend.

“Botnets” are a root cause of these problems.A “botnet” consists of a network of compromised

computers (“bots”) connected to the Internet that is controlled by a remote attacker (“botmaster”).

Botnet:Botnet is a large number of compromised computers

that are used to create and send spam or viruses or flood a network with messages as a denial of service attack.

Botnet is a term derived from the idea of bot networks. In its most basic form, a bot is simply an automated computer program, or robot.

Bots refer to computers that are able to be controlled by one, or many, outside sources.

An attacker usually gains control by infecting the

computers with a virus or other malicious code that gives the attacker access.

Existing system:

Most botnets that have appeared until now have had a common centralized architecture.

From a botmaster’s perspective, the C&C(Command &Control) servers are the fundamental weak points in current botnet architectures.

Because botmaster will lose control of their botnet once the limited number of C&C servers are shut down by defenders.

Then an entire botnet may be exposed once a C&C server in the botnet is hijacked or captured by defenders.

That is, bots in the botnet connect directly to some special hosts (called “command-and-control” servers, or “C&C” servers).

These C&C servers receive commands from their botmaster and forward them.

Proposed Architecture:

The main aim of this proposed system is design an advanced hybrid peer-to-peer botnet.

Generation of robust botnet capable of maintaining control of its remaining bots even after a substantial portion of the botnet population has been removed by defenders.

Easily monitor and obtain the complete information of a botnet by its botmaster.

A botmaster could easily monitor the entire botnet by issuing a report command.

And to prevent (or make it harder for) defenders from detecting bots via their communication traffic patterns.

Bot Master Node:

This is the server node or attacker node. This node will send instruction to any other

node. A bot master can monitor the other node. Bot Master maintain the detail about the bot. A botmaster issues a special command,

called a report command, to the botnet.It will instruct every bot to send its

information to a specified machine that is compromised and controlled by the botmaster.

Select Sensor Host

Bot Master

Connection with sensor Host

Command Initiation

Send Command Send Acknowledgement

Receive Command

Servent Bot:

Servent Bot contains bots that have static, non private IP addresses and are accessible from the global Internet.

Bots in the first group are called servent bots

since they behave as both clients and servers.

Only servent bots are candidates in peer lists.

Client Bot:Client contains the remaining bots, including

bots with dynamically allocated IP addresses,

Bots with private IP addresses will be connected to the global Internet.

This group of bots is called client bots since they will not accept incoming connections.

Monitoring by Botmaster:Another major challenge in botnet design is making sure

that a botnet is difficult to monitor by defenders.

But at the same time, easily monitored by its botmaster.

Botmaster could conduct attacks more effectively according to the bot population, distribution, on/off status, IP address types, etc.

It keep tighter control over the botnet when facing various counterattacks from defenders.

In this section, we present a simple but effective way for botmasters to monitor their botnets whenever they want.

Data Flow diagram

Command Receive from the Bot

Command preparation

Sensor Selection

Bot Master

Servent Bot

Send Command Receive Command

Bot Bot Bot

Monitoring with Honeypot

Monitoring without Honeypot

Botnet MonitoringIn this module we concentrate h0w defenders

might defend against such an advanced botnet. Here we use two concepts to monitor the botnet

1. Botnet monitoring with Honeypot.2. Botnet monitoring without Honeypot.

Botnet monitring with Honeypot:

Honey pot:In computer terminology, a honey pot is a trap

set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems.

Generally it consists of a computer, data, or a network site that appears to be part of a network

It will block the attack from botmaster.

Which seems to contain information or a resource value of attackers.

HoneypotServent Bot Client Bot

Honeypot Block Diagram:

Botnet monitoring without Honeypot.

In this honeypot is not used.Attack cannot be blocked.Botnet monitors the whole system by

scanning it.It can identify the temp file created by that

attacker.We can identify the source by the temp and

be aware for next attack.

BOTMASTER

Selecting client side IP

Monitoring with Honeypot

Monitoring without honeypot

ConclusionTo be well prepared for future botnet attacks, we should

study advanced botnet attack techniques that could be developed by botmasters in the near future.

In this project, we present the design of an advanced hybrid P2P botnet. Compared with current botnets, the proposed one is harder to be monitored, and much harder to be shut down.

To defend against such an advanced botnet, we point out

that honeypots may play an important role. We should, therefore, invest more research into

determining how to deploy honeypots efficiently and avoid their exposure to botnets and botmasters.

Reference:1. S. Kandula, D. Katabi, M. Jacob, and A. Berger, “Botz-4-Sale: Surviving Organized DDOS Attacks That Mimic Flash Crowds,” Proc. Second Symp. Networked Systems Design and Implementation (NSDI ’05), May 2005.2. C.T. News, Expert: Botnets No. 1 Emerging Internet Threat, http:// www.cnn.com/2006/TECH/internet/01/31/furst/, 2006.3. F. Freiling, T. Holz, and G. Wicherski, “Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of- Service Attacks,” Technical Report AIB-2005-07, CS Dept. RWTH Aachen Univ., Apr. 2005.4 . D. Dagon, C. Zou, and W. Lee, “Modeling Botnet Propagation Using Time Zones,” Proc. 13th Ann. Network and Distributed

System Security Symp. (NDSS ’06), pp. 235-249, Feb. 2006.

THANK YOU