Sciweavers

Share
CCS
2009
ACM

Towards complete node enumeration in a peer-to-peer botnet

10 years 1 months ago
Towards complete node enumeration in a peer-to-peer botnet
Modern advanced botnets may employ a decentralized peer-to-peer overlay network to bootstrap and maintain their command and control channels, making them more resilient to traditional mitigation efforts such as server incapacitation. As an alternative strategy, the malware defense community has been trying to identify the bot-infected hosts and enumerate the IP addresses of the participating nodes so that the list can be used by system administrators to identify local infections, block spam emails sent from bots, and configure firewalls to protect local users. Enumerating the infected hosts, however, has presented challenges. One cannot identify infected hosts behind firewalls or NAT devices by employing crawlers, a commonly used enumeration technique where recursive get-peerlist lookup requests are sent newly discovered IP addresses of infected hosts. As many bot-infected machines in homes or offices are behind firewall or NAT devices, these crawler-based enumeration methods would mi...
Brent ByungHoon Kang, Eric Chan-Tin, Christopher P
Added 23 Nov 2009
Updated 23 Nov 2009
Type Conference
Year 2009
Where CCS
Authors Brent ByungHoon Kang, Eric Chan-Tin, Christopher P. Lee, James Tyra, Hun Jeong Kang, Chris Nunnery, Zachariah Wadler, Greg Sinclair, Nicholas Hopper, David Dagon, Yongdae Kim
Comments (0)
books