On the effectiveness of structural detection and defense against P2P-based botnets

Recently, peer-to-peer (P2P) networks have emerged as a covert communication platform for malicious programs known as bots. As popular distributed systems, they allow bots to communicate easily while protecting the botmaster from being discovered. Existing work on P2P-based botnets mainly focuses on measurement of botnet sizes. In this work, through simulation, we study extensively the structure of P2P networks running Kademlia, one of a few widely used P2P protocols in practice. Our simulation testbed incorporates the actual code of a real Kademlia client software to achieve great realism, and distributed event-driven simulation techniques to achieve high scalability. Using this testbed, we analyze the scaling, reachability, clustering, and centrality properties of P2P-based botnets from a graph-theoretical perspective. We further demonstrate experimentally and theoretically that monitoring bot activities in a P2P network is difficult, suggesting that the P2P mechanism indeed helps ...

• Type: Conference
• Year: 2009
• Where: DSN
• Authors: Duc T. Ha, Guanhua Yan, Stephan Eidenbenz, Hung Q. Ngo
• Keywords: Botnet, Computer Networks, DSN 2009, P2P Networks, P2P-based Botnets