Publikationen

Autor	Karuppayah, Shankar; Vasilomanolakis, Emmanouil; Haas, Steffen; Fischer, Mathias; Mühlhäuser, Max
Datum	2016
Art	Conference Proceedings
Abstrakt	The ever-growing number of cyber attacks from botnets has made them one of the biggest threats on the Internet. Thus, it is crucial to study and analyze botnets, to take them down. For this, an extensive monitoring is a pre-requisite for preparing a botnet takedown, e.g., via a sinkholing attack. However, every new monitoring mechanism developed for botnets is usually tackled by the botmasters by introducing novel antimonitoring countermeasures. In this paper, we anticipate these countermeasures by proposing a set of lightweight techniques for detecting the presence of crawlers in P2P botnets, called BoobyTrap. For that, we exploit botnet-specific protocol and design constraints. We evaluate the performance of our BoobyTrap mechanism on two real-world botnets: Sality and ZeroAccess. Our results indicate that we can distinguish many crawlers from benign bots. In fact, we discovered close to 10 crawler nodes within our observation period in the Sality botnet and around 120 in the ZeroAccess botnet. In addition, we also describe the observable characteristics of the detected crawlers and suggest crawler improvements for enabling monitoring in the presence of the BoobyTrap mechanism.
Konferenz	IEEE International Conference on Communications (ICC 2016)
ISBN	978-1-4799-6664-6
In	2016 IEEE International Conference on Communications
Publisher	IEEE
Schlüssel	TUD-CS-2016-0035
Url	https://tubiblio.ulb.tu-darmstadt.de/id/eprint/104129