The cyber-criminal compromises end-hosts(bots)to configure a network of bots(botnet).The cyber-criminals are also looking for an evolved architecture that makes their techniques more resilient and stealthier such as P...The cyber-criminal compromises end-hosts(bots)to configure a network of bots(botnet).The cyber-criminals are also looking for an evolved architecture that makes their techniques more resilient and stealthier such as Peer-to-Peer(P2P)networks.The P2P botnets leverage the privileges of the decentralized nature of P2P networks.Consequently,the P2P botnets exploit the resilience of this architecture to be arduous against take-down procedures.Some P2P botnets are smarter to be stealthy in their Commandand-Control mechanisms(C2)and elude the standard discovery mechanisms.Therefore,the other side of this cyberwar is the monitor.The P2P botnet monitoring is an exacting mission because the monitoring must care about many aspects simultaneously.Some aspects pertain to the existing monitoring approaches,some pertain to the nature of P2P networks,and some to counter the botnets,i.e.,the anti-monitoring mechanisms.All these challenges should be considered in P2P botnet monitoring.To begin with,this paper provides an anatomy of P2P botnets.Thereafter,this paper exhaustively reviews the existing monitoring approaches of P2P botnets and thoroughly discusses each to reveal its advantages and disadvantages.In addition,this paper groups the monitoring approaches into three groups:passive,active,and hybrid monitoring approaches.Furthermore,this paper also discusses the functional and non-functional requirements of advanced monitoring.In conclusion,this paper ends by epitomizing the challenges of various aspects and gives future avenues for better monitoring of P2P botnets.展开更多
The mobile botnet, developed from the traditional PC-based botnets, has become a practical underlying trend. In this paper, we design a mobile botnet, which exploits a novel command and control （CC） strategy named P...The mobile botnet, developed from the traditional PC-based botnets, has become a practical underlying trend. In this paper, we design a mobile botnet, which exploits a novel command and control （CC） strategy named Push-Styled CC. It utilizes Google cloud messaging （GCM） service as the botnet channel. Compared with traditional botnet, Push-Styled CC avoids direct communications between botmasters and bots, which makes mobile botnets more stealthy and resilient. Since mobile devices users are sensitive to battery power and traffic consumption, Push- Styled botnet also applies adaptive network connection strategy to reduce traffic consumption and cost. To prove the efficacy of our design, we implemented the prototype of Push-Style CC in Android. The experiment results show that botnet traffic can be concealed in legal GCM traffic with low traffic cost.展开更多
The evolution and expansion of IoT devices reduced human efforts,increased resource utilization, and saved time;however, IoT devices createsignificant challenges such as lack of security and privacy, making them morev...The evolution and expansion of IoT devices reduced human efforts,increased resource utilization, and saved time;however, IoT devices createsignificant challenges such as lack of security and privacy, making them morevulnerable to IoT-based botnet attacks. There is a need to develop efficientand faster models which can work in real-time with efficiency and stability. The present investigation developed two novels, Deep Neural Network(DNN) models, DNNBoT1 and DNNBoT2, to detect and classify well-knownIoT botnet attacks such as Mirai and BASHLITE from nine compromisedindustrial-grade IoT devices. The utilization of PCA was made to featureextraction and improve effectual and accurate Botnet classification in IoTenvironments. The models were designed based on rigorous hyperparameterstuning with GridsearchCV. Early stopping was utilized to avoid the effects ofoverfitting and underfitting for both DNN models. The in-depth assessmentand evaluation of the developed models demonstrated that accuracy andefficiency are some of the best-performed models. The novelty of the presentinvestigation, with developed models, bridge the gaps by using a real datasetwith high accuracy and a significantly lower false alarm rate. The results wereevaluated based on earlier studies and deemed efficient at detecting botnetattacks using the real dataset.展开更多
Peer-to-Peer （P2P） botnet has emerged as one of the most serious threats to lnternet security. To effectively elimi- nate P2P botnet, a delayed SEIR model is proposed,which can portray the formation process of P2P b...Peer-to-Peer （P2P） botnet has emerged as one of the most serious threats to lnternet security. To effectively elimi- nate P2P botnet, a delayed SEIR model is proposed,which can portray the formation process of P2P botnet. Then, the local stability at equilibria is carefully analyzed by considering the eigenvalues＇ distributed ranges of characteristic equations. Both mathematical analysis and numerical simulations show that the dynamical features of the proposed model rely on the basic re- production number and time delay r. The results can help us to better understand the propagation behaviors of P2P botnet and design effective counter-botnet methods.展开更多
基金This work was supported by the Ministry of Higher Education Malaysia’s Fundamental Research Grant Scheme under Grant FRGS/1/2021/ICT07/USM/03/1.
文摘The cyber-criminal compromises end-hosts(bots)to configure a network of bots(botnet).The cyber-criminals are also looking for an evolved architecture that makes their techniques more resilient and stealthier such as Peer-to-Peer(P2P)networks.The P2P botnets leverage the privileges of the decentralized nature of P2P networks.Consequently,the P2P botnets exploit the resilience of this architecture to be arduous against take-down procedures.Some P2P botnets are smarter to be stealthy in their Commandand-Control mechanisms(C2)and elude the standard discovery mechanisms.Therefore,the other side of this cyberwar is the monitor.The P2P botnet monitoring is an exacting mission because the monitoring must care about many aspects simultaneously.Some aspects pertain to the existing monitoring approaches,some pertain to the nature of P2P networks,and some to counter the botnets,i.e.,the anti-monitoring mechanisms.All these challenges should be considered in P2P botnet monitoring.To begin with,this paper provides an anatomy of P2P botnets.Thereafter,this paper exhaustively reviews the existing monitoring approaches of P2P botnets and thoroughly discusses each to reveal its advantages and disadvantages.In addition,this paper groups the monitoring approaches into three groups:passive,active,and hybrid monitoring approaches.Furthermore,this paper also discusses the functional and non-functional requirements of advanced monitoring.In conclusion,this paper ends by epitomizing the challenges of various aspects and gives future avenues for better monitoring of P2P botnets.
基金Supported by the National Natural Science Foundation of China (61202353, 61272084, 61272422)Graduate Innovation Foundation of Jiangsu Province (CXLX13_464)Natural Science Foundation of Jiangsu Higher Education Institutions (12KJB520008)
文摘The mobile botnet, developed from the traditional PC-based botnets, has become a practical underlying trend. In this paper, we design a mobile botnet, which exploits a novel command and control （CC） strategy named Push-Styled CC. It utilizes Google cloud messaging （GCM） service as the botnet channel. Compared with traditional botnet, Push-Styled CC avoids direct communications between botmasters and bots, which makes mobile botnets more stealthy and resilient. Since mobile devices users are sensitive to battery power and traffic consumption, Push- Styled botnet also applies adaptive network connection strategy to reduce traffic consumption and cost. To prove the efficacy of our design, we implemented the prototype of Push-Style CC in Android. The experiment results show that botnet traffic can be concealed in legal GCM traffic with low traffic cost.
基金Authors would like to thank the Deanship of Scientific Research at Majmaah University for supporting this work under Project No.R-2021-220.
文摘The evolution and expansion of IoT devices reduced human efforts,increased resource utilization, and saved time;however, IoT devices createsignificant challenges such as lack of security and privacy, making them morevulnerable to IoT-based botnet attacks. There is a need to develop efficientand faster models which can work in real-time with efficiency and stability. The present investigation developed two novels, Deep Neural Network(DNN) models, DNNBoT1 and DNNBoT2, to detect and classify well-knownIoT botnet attacks such as Mirai and BASHLITE from nine compromisedindustrial-grade IoT devices. The utilization of PCA was made to featureextraction and improve effectual and accurate Botnet classification in IoTenvironments. The models were designed based on rigorous hyperparameterstuning with GridsearchCV. Early stopping was utilized to avoid the effects ofoverfitting and underfitting for both DNN models. The in-depth assessmentand evaluation of the developed models demonstrated that accuracy andefficiency are some of the best-performed models. The novelty of the presentinvestigation, with developed models, bridge the gaps by using a real datasetwith high accuracy and a significantly lower false alarm rate. The results wereevaluated based on earlier studies and deemed efficient at detecting botnetattacks using the real dataset.
基金National Natural Science Foundation of China(No.61379125)Program for Basic Research of Shanxi Province(No.2012011015-3)Higher School of Science and Technology Innovation Project of Shanxi Province(No.2013148)
文摘Peer-to-Peer （P2P） botnet has emerged as one of the most serious threats to lnternet security. To effectively elimi- nate P2P botnet, a delayed SEIR model is proposed,which can portray the formation process of P2P botnet. Then, the local stability at equilibria is carefully analyzed by considering the eigenvalues＇ distributed ranges of characteristic equations. Both mathematical analysis and numerical simulations show that the dynamical features of the proposed model rely on the basic re- production number and time delay r. The results can help us to better understand the propagation behaviors of P2P botnet and design effective counter-botnet methods.
