A System for Live Investigation of Next Generation Botnets Authors: Alden W. Jackson, David Lapsley, Christine Jones… CATC...
Outlines <ul><li>Introduction </li></ul><ul><li>Botnet Formation </li></ul><ul><li>C&C Feature Space </li></ul><ul><li>Sys...
Introduction <ul><li>How to characterize botnet? </li></ul><ul><ul><li>Testbeds: run real botnet software </li></ul></ul><...
Botnet Formation <ul><li>Reconnaissance </li></ul><ul><ul><li>Scan target </li></ul></ul><ul><li>Exploits </li></ul><ul><u...
C&C Feature Space <ul><li>Topology </li></ul><ul><ul><li>Amount of bots under control </li></ul></ul><ul><ul><li>Speed and...
<ul><li>Communication Protocol </li></ul><ul><ul><li>Two important features: </li></ul></ul><ul><ul><ul><li>Ease of progra...
C&C Feature Space (cont.) Data Mining & Machine Learning Lab 04/26/10
<ul><li>Botnet Scenario Driver </li></ul><ul><li>Composable Bot Framework </li></ul>System Architecture 04/26/10 Data Mini...
Botnet Scenario Driver <ul><li>Diagram </li></ul><ul><li>Scenario Manager </li></ul><ul><ul><li>To direct activities of th...
<ul><li>Diagram </li></ul><ul><li>Management Plane </li></ul><ul><ul><li>Maintaining connectivity to the botnet C&C infras...
<ul><li>Data Plane </li></ul><ul><ul><li>Enables exchange of commands and responses </li></ul></ul><ul><ul><li>Communicati...
<ul><li>C&C Topology </li></ul><ul><ul><li>Centralized </li></ul></ul><ul><ul><li>Distributed (or Peer-to-Peer) </li></ul>...
<ul><li>SLINGbot </li></ul><ul><ul><li>Facilitates the construction of benign botnets </li></ul></ul><ul><ul><ul><li>With ...
Questions? 04/26/10 Data Mining & Machine Learning Lab
04/26/10 Data Mining & Machine Learning Lab
04/26/10 Data Mining & Machine Learning Lab
Upcoming SlideShare
Loading in...5
×

A System for Live Investigation of Next Generation Botnets

425

Published on

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
425
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
5
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

A System for Live Investigation of Next Generation Botnets

  1. 1. A System for Live Investigation of Next Generation Botnets Authors: Alden W. Jackson, David Lapsley, Christine Jones… CATCH 2009 Reporter: Jing Chiu Email: D9815023@mail.ntust.edu.tw Data Mining & Machine Learning Lab 04/26/10
  2. 2. Outlines <ul><li>Introduction </li></ul><ul><li>Botnet Formation </li></ul><ul><li>C&C Feature Space </li></ul><ul><li>System Architecture </li></ul><ul><li>SLINGbog Bot Variants </li></ul><ul><li>Summary </li></ul>Data Mining & Machine Learning Lab 04/26/10
  3. 3. Introduction <ul><li>How to characterize botnet? </li></ul><ul><ul><li>Testbeds: run real botnet software </li></ul></ul><ul><ul><li>Databases: maintain traffic traces from operational data </li></ul></ul><ul><ul><li>Reverse Engineering of captured botnet binaries </li></ul></ul><ul><li>Problems: </li></ul><ul><ul><li>Limited to characterizing existing botnets </li></ul></ul><ul><ul><li>Limited control over the experiments conducted </li></ul></ul><ul><li>SLINGbot: </li></ul><ul><ul><li>Enables the characterization of both present and future botnet threats. </li></ul></ul><ul><ul><li>Enables full control over experimental scenarios </li></ul></ul>Data Mining & Machine Learning Lab 04/26/10
  4. 4. Botnet Formation <ul><li>Reconnaissance </li></ul><ul><ul><li>Scan target </li></ul></ul><ul><li>Exploits </li></ul><ul><ul><li>Let attacker be able to access vulnerable computer </li></ul></ul><ul><li>Reinforcement </li></ul><ul><ul><li>Privilege escalation </li></ul></ul><ul><li>Consolidation </li></ul><ul><ul><li>Connecting to C&C server and wait commands </li></ul></ul><ul><li>Mission Execution </li></ul><ul><ul><li>Receiving commands and executing </li></ul></ul>Data Mining & Machine Learning Lab 04/26/10
  5. 5. C&C Feature Space <ul><li>Topology </li></ul><ul><ul><li>Amount of bots under control </li></ul></ul><ul><ul><li>Speed and simplicity of sending new instructions </li></ul></ul><ul><ul><li>Botnet’s resilience to disruption </li></ul></ul><ul><ul><li>Example: centralized, hierarchical and peer-to-peer </li></ul></ul><ul><li>Rallying Mechanism </li></ul><ul><ul><li>Related to the botnet propagation mechanism </li></ul></ul><ul><ul><li>Example: seeding, database, DNS, IP </li></ul></ul>Data Mining & Machine Learning Lab 04/26/10
  6. 6. <ul><li>Communication Protocol </li></ul><ul><ul><li>Two important features: </li></ul></ul><ul><ul><ul><li>Ease of programming </li></ul></ul></ul><ul><ul><ul><li>Difficulty of detection </li></ul></ul></ul><ul><ul><li>Examples: IRC, AIM, HTTP and P2P </li></ul></ul><ul><li>Control Mechanism </li></ul><ul><ul><li>Examples: callback, polling and ongoing </li></ul></ul><ul><li>Command Authentication Mechanism </li></ul><ul><ul><li>To prevent outside parties from disabling or taking over botnets. </li></ul></ul><ul><ul><li>Example: certificates, password and none </li></ul></ul>C&C Feature Space (cont.) Data Mining & Machine Learning Lab 04/26/10
  7. 7. C&C Feature Space (cont.) Data Mining & Machine Learning Lab 04/26/10
  8. 8. <ul><li>Botnet Scenario Driver </li></ul><ul><li>Composable Bot Framework </li></ul>System Architecture 04/26/10 Data Mining & Machine Learning Lab
  9. 9. Botnet Scenario Driver <ul><li>Diagram </li></ul><ul><li>Scenario Manager </li></ul><ul><ul><li>To direct activities of the entire botnet </li></ul></ul><ul><li>Scenario Servers </li></ul><ul><ul><li>To deploy a bot or a controller </li></ul></ul><ul><li>XML scenario file </li></ul><ul><ul><li>Use for configuring experiment scenarios </li></ul></ul>04/26/10 Data Mining & Machine Learning Lab
  10. 10. <ul><li>Diagram </li></ul><ul><li>Management Plane </li></ul><ul><ul><li>Maintaining connectivity to the botnet C&C infrastructure </li></ul></ul><ul><ul><li>Topology Manager </li></ul></ul><ul><ul><ul><li>Manages peer information </li></ul></ul></ul><ul><ul><li>Session Manager </li></ul></ul><ul><ul><ul><li>Rally Mechanism </li></ul></ul></ul><ul><ul><ul><li>Control Mechanism </li></ul></ul></ul>Composable Bot Framework 04/26/10 Data Mining & Machine Learning Lab
  11. 11. <ul><li>Data Plane </li></ul><ul><ul><li>Enables exchange of commands and responses </li></ul></ul><ul><ul><li>Communication Protocol </li></ul></ul><ul><ul><ul><li>Provides protocol encapsulation/decapsulation capabilities </li></ul></ul></ul><ul><li>Communication Abstraction Layer </li></ul><ul><ul><li>Hides the details of C&C communication from the core Bot Application </li></ul></ul><ul><li>Bot Application Layer </li></ul><ul><ul><li>The core “intelligence” of a bot </li></ul></ul><ul><ul><li>Contains a set of instruction handlers </li></ul></ul><ul><ul><li>May easily be updated and expanded </li></ul></ul>Composable Bot Framework (cont.) 04/26/10 Data Mining & Machine Learning Lab
  12. 12. <ul><li>C&C Topology </li></ul><ul><ul><li>Centralized </li></ul></ul><ul><ul><li>Distributed (or Peer-to-Peer) </li></ul></ul><ul><ul><li>Hierarchical (or Hybrid) </li></ul></ul><ul><li>Bot Variants </li></ul><ul><ul><li>IRC Bot </li></ul></ul><ul><ul><li>TinyP2P Bot </li></ul></ul><ul><ul><li>Kademlia Bot </li></ul></ul><ul><ul><li>Hierarchical Kademlia Bot </li></ul></ul>SLINGbog Bot Variants 04/26/10 Data Mining & Machine Learning Lab
  13. 13. <ul><li>SLINGbot </li></ul><ul><ul><li>Facilitates the construction of benign botnets </li></ul></ul><ul><ul><ul><li>With varying command and control structures </li></ul></ul></ul><ul><ul><ul><li>Generate simulated ground truth in a controlled, safe and repeatable manner. </li></ul></ul></ul><ul><ul><ul><li>Extensible for the use of shared libraries of botnet modules </li></ul></ul></ul><ul><ul><li>Currently being adapted for deployment on the DETER Testbed </li></ul></ul>Summary 04/26/10 Data Mining & Machine Learning Lab
  14. 14. Questions? 04/26/10 Data Mining & Machine Learning Lab
  15. 15. 04/26/10 Data Mining & Machine Learning Lab
  16. 16. 04/26/10 Data Mining & Machine Learning Lab
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×