Upload
bhagath-singh-jayaprakasam
View
3.654
Download
0
Embed Size (px)
DESCRIPTION
it is a proposed architecture byPing Wang, Sherri Sparks, and Cliff C. Zou, Member, IEEE
Citation preview
MODELING BOTNET IN PEER TO PEER SYSTEMS
PRESENTED BY
J.P.Bhagath Singh B.E,M.TECH(N/W)VIT UNIVERSITY
VELLORE
&
GUIDEDBY
Prof.Chandra Mouliswaran.S
INTRODUCTION
In the last several years, Internet malware attacks have evolved into better-organized and more profit-centered endeavors.
E-mail spam, extortion through denial-of-service attacks, and click fraud represent a few examples of this emerging trend.
“Botnets” are a root cause of these problems.A “botnet” consists of a network of compromised
computers (“bots”) connected to the Internet that is controlled by a remote attacker (“botmaster”).
Botnet:Botnet is a large number of compromised computers
that are used to create and send spam or viruses or flood a network with messages as a denial of service attack.
Botnet is a term derived from the idea of bot networks. In its most basic form, a bot is simply an automated computer program, or robot.
Bots refer to computers that are able to be controlled by one, or many, outside sources.
An attacker usually gains control by infecting the
computers with a virus or other malicious code that gives the attacker access.
Existing system:
Most botnets that have appeared until now have had a common centralized architecture.
From a botmaster’s perspective, the C&C(Command &Control) servers are the fundamental weak points in current botnet architectures.
Because botmaster will lose control of their botnet once the limited number of C&C servers are shut down by defenders.
Then an entire botnet may be exposed once a C&C server in the botnet is hijacked or captured by defenders.
That is, bots in the botnet connect directly to some special hosts (called “command-and-control” servers, or “C&C” servers).
These C&C servers receive commands from their botmaster and forward them.
Proposed Architecture:
The main aim of this proposed system is design an advanced hybrid peer-to-peer botnet.
Generation of robust botnet capable of maintaining control of its remaining bots even after a substantial portion of the botnet population has been removed by defenders.
Easily monitor and obtain the complete information of a botnet by its botmaster.
A botmaster could easily monitor the entire botnet by issuing a report command.
And to prevent (or make it harder for) defenders from detecting bots via their communication traffic patterns.
Bot Master Node:
This is the server node or attacker node. This node will send instruction to any other
node. A bot master can monitor the other node. Bot Master maintain the detail about the bot. A botmaster issues a special command,
called a report command, to the botnet.It will instruct every bot to send its
information to a specified machine that is compromised and controlled by the botmaster.
Select Sensor Host
Bot Master
Connection with sensor Host
Command Initiation
Send Command Send Acknowledgement
Receive Command
Servent Bot:
Servent Bot contains bots that have static, non private IP addresses and are accessible from the global Internet.
Bots in the first group are called servent bots
since they behave as both clients and servers.
Only servent bots are candidates in peer lists.
Client Bot:Client contains the remaining bots, including
bots with dynamically allocated IP addresses,
Bots with private IP addresses will be connected to the global Internet.
This group of bots is called client bots since they will not accept incoming connections.
Monitoring by Botmaster:Another major challenge in botnet design is making sure
that a botnet is difficult to monitor by defenders.
But at the same time, easily monitored by its botmaster.
Botmaster could conduct attacks more effectively according to the bot population, distribution, on/off status, IP address types, etc.
It keep tighter control over the botnet when facing various counterattacks from defenders.
In this section, we present a simple but effective way for botmasters to monitor their botnets whenever they want.
Data Flow diagram
Command Receive from the Bot
Command preparation
Sensor Selection
Bot Master
Servent Bot
Send Command Receive Command
Bot Bot Bot
Monitoring with Honeypot
Monitoring without Honeypot
Botnet MonitoringIn this module we concentrate h0w defenders
might defend against such an advanced botnet. Here we use two concepts to monitor the botnet
1. Botnet monitoring with Honeypot.2. Botnet monitoring without Honeypot.
Botnet monitring with Honeypot:
Honey pot:In computer terminology, a honey pot is a trap
set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems.
Generally it consists of a computer, data, or a network site that appears to be part of a network
It will block the attack from botmaster.
Which seems to contain information or a resource value of attackers.
HoneypotServent Bot Client Bot
Honeypot Block Diagram:
Botnet monitoring without Honeypot.
In this honeypot is not used.Attack cannot be blocked.Botnet monitors the whole system by
scanning it.It can identify the temp file created by that
attacker.We can identify the source by the temp and
be aware for next attack.
BOTMASTER
Selecting client side IP
Monitoring with Honeypot
Monitoring without honeypot
ConclusionTo be well prepared for future botnet attacks, we should
study advanced botnet attack techniques that could be developed by botmasters in the near future.
In this project, we present the design of an advanced hybrid P2P botnet. Compared with current botnets, the proposed one is harder to be monitored, and much harder to be shut down.
To defend against such an advanced botnet, we point out
that honeypots may play an important role. We should, therefore, invest more research into
determining how to deploy honeypots efficiently and avoid their exposure to botnets and botmasters.
Reference:1. S. Kandula, D. Katabi, M. Jacob, and A. Berger, “Botz-4-Sale: Surviving Organized DDOS Attacks That Mimic Flash Crowds,” Proc. Second Symp. Networked Systems Design and Implementation (NSDI ’05), May 2005.2. C.T. News, Expert: Botnets No. 1 Emerging Internet Threat, http:// www.cnn.com/2006/TECH/internet/01/31/furst/, 2006.3. F. Freiling, T. Holz, and G. Wicherski, “Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of- Service Attacks,” Technical Report AIB-2005-07, CS Dept. RWTH Aachen Univ., Apr. 2005.4 . D. Dagon, C. Zou, and W. Lee, “Modeling Botnet Propagation Using Time Zones,” Proc. 13th Ann. Network and Distributed
System Security Symp. (NDSS ’06), pp. 235-249, Feb. 2006.
THANK YOU