The case for in-the-lab botnet experimentation: creating and taking down a 3000-node botnet

(Publication) Google search: [1]

The case for in-the-lab botnet experimentation: creating and taking down a 3000-node botnet
Botnet	Waledac
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol
Date	2010 / ACSAC 2010
Editor/Conference	Annual Computer Security Applications Conference
Link	http://www.acsac.org/2010/openconf/modules/request.php?module=oc program&action=summary.php&id=221 www.acsac.org (www.acsac.org Archive copy)
Author	Joan Calvet, Carlton R. Davis, José M. Fernandez, Jean-Yves Marion, Pier-Luc St-Onge, Wadie Guizani, Pierre-Marc Bureau, Anil Somayaji
Type

Abstract

“ Botnets constitute a serious security problem. A lot of effort has been invested towards understanding them better, while developing and learning how to deploy effective counter-measures against them. Their study via various analysis, modelling and experimental methods are integral parts of the development cycle of any such botnet mitigation schemes. It also constitutes a vital part of the process of understanding present threats and predicting future ones.

Currently, the most popular of these techniques are “in-the-wild” botnet studies, where researchers interact directly with real-world botnets. This approach is less than ideal, for many reasons that we discuss in this paper, including scientific validity, ethical and legal issues. Consequently, we present an alternative approach employing “in the lab” experiments involving at-scale emulated botnets. We discuss the advantages of such an approach over reverse engineering, analytical modelling, simulation and in-the-wild studies. Moreover, we discuss the requirements that facilities supporting them must have. We then describe an experiment in which we emulated a close to 3000-node, fully-featured version of the Waledac botnet, complete with a reproduced command and control (C&C) infrastructure. By observing the load characteristics and yield (rate of spamming) of such a botnet, we can draw interesting conclusions about its real-world operations and design decisions made by its creators. Furthermore, we conducted experiments where we launched sybil attacks against the botnet. We were able to verify that such an attack is, in the case of Waledac, viable. However, we were able to determine that mounting such an attack is not so simple: high resource consumption can cause havoc and partially neutralise the attack. Finally, we were able to repeat the attack with varying parameters, in an attempt to optimise it. The merits of this experimental approach is underlined by the fact that it is very difficult to obtain these results by employing other methods.

Bibtex

 @misc{2010BFR882,
   editor = {Annual Computer Security Applications Conference},
   author = {Joan Calvet, Carlton R. Davis, José M. Fernandez, Jean-Yves Marion, Pier-Luc St-Onge, Wadie Guizani, Pierre-Marc Bureau, Anil Somayaji},
   title = {The case for in-the-lab botnet experimentation: creating and taking down a 3000-node botnet},
   date = {},
   month = ,
   year = {2010},
   howpublished = {\url{http://www.acsac.org/2010/openconf/modules/request.php?module=oc_program&action=summary.php&id=221 www.acsac.org}},
 }