Friday, October 18, 2008
3:00 - 4:30 PM, ST II, Room 430

A First Step Toward Live Botmaster Traceback

Assistant Professor
Computer Science Department
George Mason University

Abstract

Despite the increasing botnet threat, research in the area of botmaster traceback is limited. The four main obstacles are:
1) the low-traffic nature of the bot-to-botmaster link; 2) chains of ``stepping stones''; 3) the use of encryption along these chains; and 4) mixing with traffic from other bots.

Most existing traceback approaches can address one or two of these issues individually, but they cannot handle all of them simultaneously. To address all four problems, we present a novel flow watermarking technique that allows us to uniquely identify and trace any IRC-based botnet flow even if 1) it is encrypted (e.g., via SSL/TLS); 2) it passes multiple intermediate stepping stones (e.g., IRC server, SOCKs); 3) it is mixed with other botnet traffic. Our watermarking scheme relies on adding whitespace padding characters to outgoing IRC messages at the application layer. This produces specific differences in lengths between randomly chosen pairs of messages in a given stream. As a result, our botnet flow watermarking technique only requires a few dozens of packets to be effective. To the best of our knowledge, this is the first approach that has the potential to allow real-time botmaster traceback across the Internet.

We have empirically validated the effectiveness of our botnet flow watermarking approach with live experiments on Planetlab nodes and public IRC servers on different continents. We have been able to achieve virtually 100% detection rate of watermarked (encrypted and unencrypted) IRC traffic with false positive rate on the order of 10*{-5} in all our experiments. Due to the message queuing and throttling functionality of IRC servers, mixing chaff with the watermarked flow does not significantly impact the effectiveness of our watermarking approach.

Speaker Bio