2009 International Conference on Availability, Reliability and Security (2009)
Fukuoka Institute of Technology, Fukuoka, Japan
Mar. 16, 2009 to Mar. 19, 2009
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ARES.2009.59
Currently, botnets use peer-to-peer (P2P) networks for command and control (C&C) communication. In contrast to traditional centralized-organized botnets, P2P-based botnets do not have a central point of failure for botnets and are consequently more concealable and robust, which degrades the performance of botnet detection approaches significantly. Considering that the C&C flows related to a P2P-based bot exhibit stability on statistical meaning due to the impartial position in botnet and performing pre-programmed control activities automatically, a novel detection approach based on the control flow stability is proposed in this paper. The measurement of control flow stability is firstly derived from the P2P-based C&C case study and the definition of control flow stability. After analyzing the stability of Storm bots and comparing the results to that of normal P2P client, a stability detection algorithm that can tune the accuracy of detecting results is developed. Extensive experimental results show the proposed approach is very efficient and can detect P2P-based botnet with low false positive ratio.
Botnet, P2P, Control Flow, Stability
Z. Li, H. Tu, B. Wang and J. Ma, "Measuring Peer-to-Peer Botnets Using Control Flow Stability," 2009 International Conference on Availability, Reliability and Security(ARES), Fukuoka Institute of Technology, Fukuoka, Japan, 2009, pp. 663-669.