Heuristics for Detecting Botnet Coordinated Attacks

Μέγεθος: px

Εμφάνιση ξεκινά από τη σελίδα:

Download "Heuristics for Detecting Botnet Coordinated Attacks"

Χλόη Σερπετζόγλου
5 χρόνια πριν
Προβολές:

1 Vol. 51 No (Sep. 2010) CCC DATAset 2009 PC Heuristics for Detecting Botnet Coordinated Attacks Kazuya Kuwabara, 1 Hiroaki Kikuchi, 1 Masato Terada 2 and Masashi Fujiwara 2 This paper studies the analysis on the CCC DataSet 2009 consisting of connection data observed by 94 decoy computers, called honeypot, for clarifying behavior of downloads of the malware and the port-scans. Based on the analysis, it is found that several malicious servers often coordinate to attack a single target hosts by sending some kinds of malware. The behavior, particularly observed in botnet, is defined as a coordinated attack. The paper proposes heuristic techniques for detection of the coordinated attack and reports the accuracy of the proposed heuristics. 1 Graduate School of Engineering, Tokai University 2 Hitachi Ltd MW PC MW DL 1 IRC 2 2) 3) 4) 5) DNS 7) 2 8) MW DL MW MW WORM_SWTYMLAI.CD WO3 MW DoS 3 MW MW PC DL ) IP MW 2 69 DL 1) 2 Internet Relay Chat 3 7 WO3 3 MW s4 DoS SMTP 1600 c 2010 Information Processing Society of Japan

2 MW IP IRC CCC 94 CCC DATAset 2009 DL MW (1) (2) (3) CCC DATAset 2009 BotHunter 9) BotSniffer 10) BotHunter MW PC MW PC BotSniffer MW PC C&C 1 IRC 2 CCC DATAset 3 MW C&C Command and Control PC MW CCC DATA set tcpdump libpcap 11) 1 OS Windows 2000 XP 2 OS OS MW MW MW Table 1 List of MWs observed for two days. MW UH DL PE_VIRUT.AV PE TCP PE_BOBAX.AK PE TCP PE_VIRUT.AT PE3 1 1 TCP BKDR_POEBOT.GN BK TCP BKDR_MYBOT.AH BK UDP BKDR_RBOT.ASA BK3 4 5 UDP TROJ_AGENT.ARWZ TR1 1 6 TCP TROJ_BUZUS.AGB TR TCP WORM_ALLAPLE.IK WO1 1 1 TCP WORM_POEBOT.AX WO2 1 1 TCP WORM_SWTYMLAI.CD WO TCP WORM_AUTORUN.CZU WO4 1 3 TCP WORM_IRCBOT.CHZ WO5 1 1 TCP UNKNOWN UK 1 5 TCP 2 CCC DATASet Windows XP NTP NTP

3 MW Table 2 Attack patterns for each single MW. MW s4 r2 DoS SMTP PE_VIRUT.AV PE_BOBAX.AK BKDR_POEBOT.GN WORM_SWTYMLAI.CD TROJ_BUZUS.AGB Table 3 3 List of characteristics used to classify. slot ID(0,...,145) P I,P O [pkt] MZ MZ PE PE DOS!This program cannot be run in DOS mode. win!windows Program N, J NICK JOIN ip1 #las6 * ipscan s.s.s.s dcom2 -s ip2 #last * ipscan s.s.s.s dcom2 -s ST (s 2 s 3 s 4 r 3) DL MW UH DL PE_VIRUT.AV MW 8 MW DL MW 2 WORM_SWTYMLAI.CD MW P I P O MW 4 Network Grep 12) s r 3 3 IP MW 11) UNKNOWN MW CCC DATAset total ave 145 MW 58 5 Rule 1 5 Rule 6 8 MW Rule DL 1 MW MW MW DL IP 1 S 1 S 2 S 3 3 /DL PE t 0 TROJ WORM MW t 2 Rule 1 TROJ WORM C&C S 0 IRC NICK 1 JOIN Rule 2 t 4 MW MW 1 NICK C&C

4 Table 4 Characteristic values for slot (snipped). P I P O MZ PE DOS N J ip1 ip2 ST(s 4) MW , PE1 TR2 WO , , ip WO1 PE1 TR2 WO , ip PE1 TR2 WO3 PE , ip BK1 TR2 WO , ip BK1 WO3 TR2 BK BK , PE1 2 TR2 WO , ip PE2 WO4 WO , ip PE2 WO4 WO3 3 total 44,452 3,038, ave , Table 5 5 List of rules for feature of coordinated attacks. NO. Rule 1 PE_VIRUT.AV WORM_SWTYMLAI.CD TROJ_BUZUS.AGB 1 Rule 2 WORM_SWTYMLAI.CD TROJ_BUZUS.AGB JOIN 1 Rule 3 WORM_SWTYMLAI.CD TROJ_BUZUS.AGB DL 6 8 Rule 4 PE_VIRUT.AV 5 6 Rule 5 WORM_SWTYMLAI.CD TROJ_BUZUS.AGB 80 6 Rule 6 PE_VIRUT.AV DL Rule 7 IRC JOIN 5 3 Rule Rule 9 MZ PE TCP 4 Rule 10 UDP win TFTP IRC JOIN ΔT 1 = t 2 t 1 ΔT 2 = t 4 t 2 6 PE_VIRUT.AV DL IP WORM_SWTYMLAI.CD TROJ_BUZUS.AGB DL IP Rule 3 PE_VIRUT.AV 5 Rule 4 TROJ_BUZUS.AGB WORM_SWTYMLAI.CD 80 Rule 5 MW

5 1604 Table 7 7 All patterns of coordinated attacks and statistics. ID ΔT 1 1 PE1 TR2 WO s BK1 TR2 WO s PE2 WO4 WO s4 DOS SMTP WO1 2 1 r Table 6 Connections of coordinated attack pattern #1. srcip dstport MW 0 0:02: A1.B1 47,556 PE_VIRUT.AV 0 0:03: C1.D1 80 TROJ_BUZUS.AGB 0 0:03: E1.F1 80 WORM_SWTYMLAI.CD 2 0:36: A2.B2 33,258 PE_VIRUT.AV 2 0:36: E1.F1 80 WORM_SWTYMLAI.CD 2 0:36: C1.D1 80 TROJ_BUZUS.AGB 3 0:46: A2.B2 33,258 PE_VIRUT.AV 3 0:48: C1.D1 80 TROJ_BUZUS.AGB 3 0:48: E1.F1 80 WORM_SWTYMLAI.CD 16 5:17: A3.B3 15,224 PE_VIRUT.AV 16 5:18: C1.D1 80 TROJ_BUZUS.AGB 16 5:18: E1.F1 80 WORM_SWTYMLAI.CD Fig. 1 1 Time-line chart of connection in typical coordinated attacks. 8 Table 8 MW DL Unique DL servers for each MW. MW 1 7 MW DL 1 MW ΔT 1 MW DL PE_VIRUT.AV 10 TROJ WORM DL MW DL PE_VIRUT.AV 10 TROJ_BUZUS.AGB 1 WORM_SWTYMILAI.CD 1 PC IP 3 IP 1 2 Rule 6 IP 3 4 IP [s]

6 DL IP Table 9 IP addresses of DL servers, honeypots and target networks. slot DL C1.D E1.F E1.F C2.D E2.F E2.F C2.D E2.F E2.F C3.D E3.F E3.F C4.D E4.F E4.F 4+1 A.B.C.D A.B.E.F A.B.E.F +1 3 JOIN Scan ΔT 2 Fig. 3 Distribution of time difference between begining of measure JOIN and of port-scan ΔT 2. ΔT 2 26 s 4 JOIN 5 Rule MW 4 MZ PE Rule UDP UDP tftp 6 MW 5 BKDR_RBOT.ASA 1 BKDR_MYBOT.AH Rule 10 2 Fig. 2 Number of inbound/outbound packets per second in time slot. 256 Rule s 4 3 r 3 2 JOIN ΔT 2 3 X JOIN Y P I 85 DOS exe

7 1606 Fig. 5 5 C4.5 Decision tree to detect arbtrary infections generated by C4.5. Fig. 4 Table 10 4 Decision tree classifying arbitrary infections (including coordinated attacks). 10 Accuracy of decision tree to detect infection (including coordinated attack). \ total slot !This program cannot be run in DOS mode. Y N Windows XP Windows 2000 C4.5 13),14) (49/0) Out_pkt < False Positive i Rule j x ij =1 i S i = 9 xij j PE2 WO4 WO3 1 1 CCC 1 7 7

8 Table 11 Relationship between Heuristics score and coordinated attacks (snipped). Table 12 Accuracy of heuristics to detect coordinated attacks. Rule i S i total \ FP FN /28 0/ /3 0/7 Table Rule Freaquency and ratio of satisfication for each rule. [ ] [ ](%) Rule 1 17/145 17/38 (45%) Rule 2 17/145 17/27 (89%) Rule 3 22/145 22/27 (81%) Rule 4 17/145 17/17 (100%) Rule 5 17/145 17/17 (100%) Rule 6 17/145 17/17 (100%) Rule 7 28/145 28/28 (100%) Rule 8 28/145 26/28 (93%) Rule 9 55/145 55/63 (87%) Rule 10 6/145 6/6 (100%) 13 Rule PE_VIRUT.AV 38 WORM TROJ Fig. 6 Distribution of heuristics scores. DATAset CCC DATAset 2009 UDP MW 2/28 7% FP FN MW 2.2

9 1608 DNS 1) 2008 MWS2008 pp (2008). 2) 2008 MWS2008 pp (2008). 3) 2008 MWS2008 pp (2008). 4) 2008 MWS2008 pp (2008). 5) pp (2008). 6) 2008 MWS2008 pp (2008). 7) DNS 2008 MWS2008 pp (2008). 8) 2008 MWS2008 pp (2008). 9) Gu, G., Zhang, J. and Lee, W.: Botsniffer: Detecting botnet command and control channel, Proc. Network and Distributed System Security Symposium (NDSS 2008 ), Internet Society (Feb. 2008). 10) Gu, G., Porras, P., Yegneswaran, V., Fong, M. and Lee, W.: BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation, Proc. 16th USENIX Security Symposium, USENIX (2007). 11) 2009 MWS2009 pp.1 8 (2009). 12) Network Grep. ( ) 13) Quinlan, J.R.: C4.5 Progarams for Machine Learning, Morgan Kaufmann, San Mateo, California. 14) GUI ID3E 67 Vol.w-8, No.3, pp (2005). 15) tcpflow. jelson/software/tcpflow/ ( ) 16) 2008 MWS2008 pp (2008). 17) C&C FIT2007, L-033, pp (2007). ( ) ( ) CCC DATAset PC 2009 A.1 MW tcpflow 15) MW 14 MW HTTP UDP

1609 14 MW Table 14 Identification of MW name.

2010 2009 MWS 1986 2004 Hitachi Incident

8 2008 Hitachi Incident Response Team 1988

1997 1998 2009 CSEC WIDE FJPEM ICAT IPA 1990

10 MW Table 14 Identification of MW name. MW TCP 192/ /192 UDP 6/6 6/6 / MW / MWS Hitachi Incident Response Team JPCERT Hitachi Incident Response Team CSEC WIDE FJPEM ICAT IPA SCIS 2010 JIP Outstanding Paper Award IEEE ACM

Σχετικά έγγραφα

GPU. CUDA GPU GeForce GTX 580 GPU 2.67GHz Intel Core 2 Duo CPU E7300 CUDA. Parallelizing the Number Partitioning Problem for GPUs

GPU. CUDA GPU GeForce GTX 580 GPU 2.67GHz Intel Core 2 Duo CPU E7300 CUDA. Parallelizing the Number Partitioning Problem for GPUs GPU 1 1 NP number partitioning problem Pedroso CUDA GPU GeForce GTX 580 GPU 2.67GHz Intel Core 2 Duo CPU E7300 CUDA C Pedroso Python 323 Python C 12.2 Parallelizing the Number Partitioning Problem for