The document proposes a design for an advanced hybrid peer-to-peer botnet that is harder for defenders to detect and shut down. It describes existing centralized botnets that rely on command-and-control servers that can be shut down. The proposed design uses a hybrid peer-to-peer architecture with servent and client bots to distribute commands across the network in a decentralized way. It also describes how the botmaster can monitor the entire botnet by having bots report information directly. Defenders could use honeypots to detect and block the botnet, but it may still be difficult to monitor without exposing the honeypots.

1. MODELING BOTNET IN PEER TO PEER SYSTEMSPRESENTED BYJ.P.BhagathSingh B.E,M.TECH(N/W)VIT UNIVERSITYVELLORE&GUIDEDBYProf.ChandraMouliswaran.S

2. INTRODUCTIONIn the last several years, Internet malware attacks have evolved into better-organized and more profit-centered endeavors. E-mail spam, extortion through denial-of-service attacks, and click fraud represent a few examples of this emerging trend.“Botnets” are a root cause of these problems.A “botnet” consists of a network of compromised computers (“bots”) connected to the Internet that is controlled by a remote attacker (“botmaster”).

3. Botnet:Botnet is a large number of compromised computers that are used to create and send spam or viruses or flood a network with messages as a denial of service attack. Botnet is a term derived from the idea of bot networks. In its most basic form, a bot is simply an automated computer program, or robot.Bots refer to computers that are able to be controlled by one, or many, outside sources.An attacker usually gains control by infecting the computers with a virus or other malicious code that gives the attacker access.

4. Existing system:Most botnets that have appeared until now have had a common centralized architecture.From a botmaster’s perspective, the C&C(Command &Control) servers are the fundamental weak points in current botnet architectures.Because botmaster will lose control of their botnet once the limited number of C&C servers are shut down by defenders.Then an entire botnet may be exposed once a C&C server in the botnet is hijacked or captured by defenders. That is, bots in the botnet connect directly to some special hosts (called “command-and-control” servers, or “C&C” servers). These C&C servers receive commands from their botmaster and forward them.

6. Proposed Architecture:

7. The main aim of this proposed system is design an advanced hybrid peer-to-peer botnet. Generation of robust botnet capable of maintaining control of its remaining bots even after a substantial portion of the botnet population has been removed by defenders. Easily monitor and obtain the complete information of a botnet by its botmaster.A botmaster could easily monitor the entire botnet by issuing a report command.And to prevent (or make it harder for) defenders from detecting bots via their communication traffic patterns.

8. Bot Master Node:This is the server node or attacker node. This node will send instruction to any other node. A bot master can monitor the other node.Bot Master maintain the detail about the bot. A botmaster issues a special command, called a report command, to the botnet.It will instruct every bot to send its information to a specified machine that is compromised and controlled by the botmaster.

9. Bot MasterSelect Sensor HostCommand InitiationReceive CommandConnection with sensor HostSend AcknowledgementSend Command

10. ServentBot:ServentBot contains bots that have static, non private IP addresses and are accessible from the global Internet.Bots in the first group are called servent bots since they behave as both clients and servers. Only servent bots are candidates in peer lists.

11. Client Bot:Client contains the remaining bots, including bots with dynamically allocated IP addresses, Bots with private IP addresses will be connected to the global Internet. This group of bots is called client bots since they will not accept incoming connections.

12. Monitoring by Botmaster:Another major challenge in botnet design is making sure that a botnet is difficult to monitor by defenders.But at the same time, easily monitored by its botmaster.Botmaster could conduct attacks more effectively according to the bot population, distribution, on/off status, IP address types, etc. It keep tighter control over the botnet when facing various counterattacks from defenders. In this section, we present a simple but effective way for botmasters to monitor their botnets whenever they want.

13. Data Flow diagramBot MasterCommand preparationCommand Receive from the BotSend CommandReceive CommandSensor SelectionServent BotBotBotBotMonitoring without HoneypotMonitoring with Honeypot

14. Botnet MonitoringIn this module we concentrate h0w defenders might defend against such an advanced botnet. Here we use two concepts to monitor the botnetBotnet monitoring with Honeypot.Botnet monitoring without Honeypot.

15. Botnetmonitring with Honeypot:Honey pot:In computer terminology, a honey pot is a trap set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems.Generally it consists of a computer, data, or a network site that appears to be part of a networkIt will block the attack from botmaster.Which seems to contain information or a resource value of attackers.

16. Honeypot Block Diagram:HoneypotServent BotClient Bot

17. Botnet monitoring without Honeypot.In this honeypot is not used.Attack cannot be blocked.Botnet monitors the whole system by scanning it.It can identify the temp file created by that attacker.We can identify the source by the temp and be aware for next attack.

18. BOTMASTER

20. Selecting client side IP

21. Monitoring with Honeypot

23. Monitoring without honeypot

24. ConclusionTo be well prepared for future botnet attacks, we should study advanced botnet attack techniques that could be developed by botmasters in the near future. In this project, we present the design of an advanced hybrid P2P botnet. Compared with current botnets, the proposed one is harder to be monitored, and much harder to be shut down.To defend against such an advanced botnet, we point out that honeypots may play an important role.We should, therefore, invest more research into determining how to deploy honeypots efficiently and avoid their exposure to botnets and botmasters.

25. Reference:1. S. Kandula, D. Katabi, M. Jacob, and A. Berger, “Botz-4-Sale: Surviving Organized DDOS Attacks That Mimic Flash Crowds,” Proc. Second Symp. Networked Systems Design and Implementation (NSDI ’05), May 2005.2. C.T. News, Expert: Botnets No. 1 Emerging Internet Threat, http:// www.cnn.com/2006/TECH/internet/01/31/furst/, 2006.3. F. Freiling, T. Holz, and G. Wicherski, “Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of- Service Attacks,” Technical Report AIB-2005-07, CS Dept. RWTH Aachen Univ., Apr. 2005.4 . D. Dagon, C. Zou, and W. Lee, “Modeling Botnet Propagation Using Time Zones,” Proc. 13th Ann. Network and Distributed System Security Symp. (NDSS ’06), pp. 235-249, Feb. 2006.

26. THANK YOU