CRESTBOT: A New Family of Resilient Botnets

Transcription

1 CRESTBOT: A New Family of Resilient Botnets Duc T. Ha, Hung Q. Ngo, Madhusudhanan Chandasekaan Depatment of Compute Science and Engineeing State Univesity of New Yok at Buffalo Amhest, NY 1426, USA {ducha,hungngo,mc79}@buffalo.edu Abstact We show that it is possible to design botnet stuctues called CRESTBOT based on extacto gaphs which ae highly esilient to command-and-contol (C&C) take-downs, yet do not equie significant changes to existing botnet designs and codes, and do not suffe fom the implementation complexity of P2P-based and hybid stuctues. The UDP family of CRESTBOT is shown to be able to send commands fom the botmaste much faste than taditional botnet. Ou analyses ae validated by extensive expeiments on Emulab. Ou esults pove that cuent C&C-takedown solutions ae ineffective against well designed botnets such as ou CRESTBOT. Secondly, shot UDP commands can be as eliable as TCP commands with much less time consumption. Thid, extemely fast command issuing is possible, which at fist glance might seem beneficial to the attacke; howeve, it might also be of use fo the good guys when cetain ace conditions ae desied such as softwae patching o quick bot takedowns. Index Tems CRESTBOT, bot, botnet, esiliency, expande I. INTRODUCTION Bot netwoks (botnets) ae an extemely seious poblem of today s netwoking infastuctue, economy, and national secuity. These netwoks of lage numbes of compomised machines (bots) ae used by attackes (botmastes) to pofit fom DDoS attacks, spam elaying, identity theft, click faud, malwaes, etc. Industy estimates have suggested that botnets have become eve-so pevalent involving moe than 1 million Intenet hosts [1] Most cuent botnets employ a hieachical design with the botmaste contolling the compomised machines using Intenet Relay Chat (IRC). Commands ae issued by the botmaste to a small numbe of specially designated nodes called command-and-contol (C&C) nodes whee they ae elayed to the emaining bots. The botmaste s identity is thus hidden behind a laye of C&C, making souce-taceback vey difficult. Recent defense solutions have focused on C&C node detection and take-down to disupt and limit botnets scope. A C&C node taken down means all the bots subscibing to it ae puned, theeby educing the botnet s size and capacity. Moeove, as each C&C node seves a elatively lage numbe of bots, it is possible to tack them using honeypots and DNSbased analysis. Consequently, sophisticated botnet vaiants have ecently emeged which adopt pee-to-pee (P2P) stuctue using some well known P2P-based potocol such as Kademlia [2], Gnutella, etc. Unlike C&C-based botnets, P2P-based botnets ae moe esilient to node failues. Compomising a node only gives out its neighbos. Though effective, diect adoption of P2P-based botnets is not staightfowad due to the complex and esouce-demanding natue of P2P potocols. A hybid P2P-based botnet has also been poposed [3] which daws on the advantages of P2P-based potocol while having C&C like nodes to assist in faste and efficient command popagation. Howeve, implementation of such a hybid appoach is athe unconventional, equiing significant changes to the existing botnet design and code. We will show that it is possible to design botnet stuctues which ae highly esilient to C&C take-downs, yet do not equie significant changes to existing botnet designs and codes, do not suffe fom the implementation complexity of P2P-based and hybid stuctues. Ou poposed stuctue is named CRESTBOT, fo C&C-based RESilienT Botnet. Resiliency often equies some degee of edundancy, which may demand othe esouces such as time and space. We will show that the space equiement of CRESTBOT is negligible; and, moe impotantly, it is possible to keep command boadcast time almost as fast as non-esilient stuctues by using UDP commands instead of TCP as befoe. CRESTBOT is designed based on extactos, a kind of expanding gaphs vey pevasive in compute science nowadays [4]. We veify ou esults both analytically and expeimentally using Emulab []. The dive-home points of this eseach ae as follows. Fist, C&C-takedown solutions ae ineffective against CRESTBOT, which is vey simple to implement and equies minimal changes to existing botcodes. Second, with popely designed dissemination stuctues, shot UDP commands can be as eliable as TCP commands with much less time consumption. This could potentially be used in othe aeas of netwoking. Thid, extemely fast command issuing is possible, which at fist glance might seem beneficial to the attacke; howeve, it might also be beneficial to the good guys when cetain ace conditions ae desied (patching, bot takedowns, etc.). The emainde of the pape is oganized as follows. Section 2 eviews selected elated woks. Section 3 analyzes the esiliency of existing C&C-based botnet and poposed new stuctues with stong esiliency guaantee. In Section 4, we expeimentally validate the analyses. Finally, we conclude and discuss defense appoaches dawn fom ou wok in Section /8/$2. 28 IEEE. 1

2 II. SELECTED RELATED WORK Existing studies on botnets fall unde the following two main categoies: (i) Pefom case-study of botnet behavios and stuctues; (ii) Popose techniques fo botnet detection and disuption. Fo example, Feiling et al. [6] infiltated a eal botnet to identify C&Cs and study bot commands. Rajab et al. [7] employed a multifaceted and distibuted infastuctue to study botnet behavios. Othes woks focused on measuing botnet size by vaious techniques such as by DNS ediection [8] o DNS cache snooping [9]. Recently, seveal techniques have also been poposed to detect botnet existence: anomaly detection [1], taffic o netwok activity statistics analyses [11]. To the best of ou knowledge, this pape is the fist to analyze taditional botnet and thei vaiances esiliency and show how command issuing can be made vey fast. Incidents fom the past have showed us that malicious pogams always evolve into instances with moe and moe advanced featues and techniques (the UDP wom Slamme is a good example). In fact, botnets with moe esilient topologies using P2P stuctues have aleady aisen [12]. Reseach on hypothetically poweful botnets such as ous is thus impotant to pepae fo the wost, to develop, test, and benchmak counte-measue systems in advance. III. BOTNET RESILIENCY AND CRESTBOT A. Resiliency of a Taditional Botnet Topology Fo a taditional C&C botnet (Figue 1(a)), the botmaste fist infects (diectly o indiectly) vulneable PCs with malicious softwaes called bots. Each bot then contacts a cental seve though which the botmaste elays commands as well as collects feedback infomation fom the bots. The C&Cs can eithe be public seves (often Intenet Chat Potocol o IRC seves) o dedicated machines set up by the botmaste to function as C&Cs. Depending on how the botmaste commands each the bots, botnets can also be categoized into push o pull style. In a push style C&C, the C&Cs fowad commands fom the botmaste to the bots in eal time, while in a pull style, bots contact the C&C fo new commands. Most common bot families such as AgoBot, PhatBot, GTBot [6] belong to this categoy. HTTP-based botnets on the othe hand ae pull-style botnets, whee bots quey (e.g using GET and POST) a web seve fo new commands fom the botmaste. Whicheve the botnet s type is, its esiliency can be measued by the expected numbe of bots who still eceive commands (in push-style botnets) o still can each the botmaste (in the pull-style botnets) given the pobability that C&Cs ae down (o the faction of C&Cs which ae down). C&C based botnets can be viewed as a 3-level tee topology shown in Figue 1(b). Node v epesents the botmaste, x i, 1 i M epesents the C&Cs and y j, 1 j N epesent the bots. Fo the sake of claity, we assume that each C&C is in chage of d bots, though ou analysis applies fo any C&C degee. Let p be the pobability that a C&C is taken down, the expected numbe of uneachable bots is then N(1 p ). y 1 x 1 Fig. 1. (a) Typical Botnet Scenaio x 2 v x M 1 y 2 y 3 y 4 y N 3 y N 2 y N 1 y N (b) Modeled Topology x M Typical and Modeled C&C Botnet Topology This taditional topology is thus not vey esilient: the numbe of affected bots is linealy popotional to 1 p.anadvesay (e.g a system administato o secuity analyst) with the ight emoval stategy of the C&Cs (e.g. emove heavily loaded C&C) can isolate a majo potion of the botnet. Since the numbe of C&Cs is much smalle than the numbe of bots, an advesay then needs elatively little effot to cipple a lage botnet. B. Fist Attempt at a Moe Resilient Stuctue One potential way to impove esiliency is to employ P2P topologies o to ely on existing P2P netwoks. Fo example, Peacomm [12] employs a P2P netwok fo its C&Cs. Howeve, P2P potocols impose exta outing and maintenance ovehead, making the botnet moe pone to being detected. On the othe hand, the communication suppotive natue of IRC, the availability of public IRC seves o web seves make it much easie fo the botmaste to oganize a C&C-based botnet. We thus believe C&C-based botnets and the likes will emain popula in the nea futue. To incease the taditional stuctue esiliency, a natual appoach is to incease the numbe of paths fom the oot to each bot. It is thus sensible to let each bot connect to b C&Cs. Let Z denote the numbe of eachable bots, then d M k N /8/$2. 28 IEEE. 2

3 v X = X i c copies G 1 G c 1 G c Y 1 Y c 1 The G i ae all copies of the same gaph H Fig. 2. The Resilient Topology R Y c Bot Alive Ratio Standad Topo, b=1.3 Resilient Topo, b=2 Resilient Topo, b=3.2 Resilient Topo, b=4 Resilient Topo, b=.1 Resilient Topo, b=6 Resilient Topo, b= C&C Down Pobability E[Z] =N(1 p b ). The negative effect of emoved C&Cs on the numbe of bots is now educed exponentially while the botcode changes equied ae minimal. In ode to guaantee that (1 )N bots ae eachable with pobability at least (1 δ), how lage should b be? The distibution of Z is binomial with paamete (1 p b ). Thus, it will be concentated aound the mean. To guaantee that Z>(1 )N with high pobability, we thus will need p b to be quite a bit less than. Moe concetely, by Chenoff bound h i Pob[Z <(1 )N] =Pob (1 p b)(1 pb )N ½ ³ < exp N 2 (1 p b 2¾ n o pb ) =exp N 2 1 p b Z< (1 ) ( p b )2 1 p b which is at most δ if, afte simple calculus, p b 1 2N ln(1/δ) (1 ) 1 N ln(1/δ)+ 1 4N 2 ln2 (1/δ) This guaantee may not even be possible with paametes fo which 1 2N ln(1/δ) (1 ) 1 N ln(1/δ)+ 1 4N 2 ln2 (1/δ) (like when is elatively small). Even when is not too small, the equied value of b maybetoolagetobeuseful pactically. Fistly, the physical capacity of C&Cs is usually limited. Fo example, a chat channel typically hosts aound a hunded uses o less, and a chat seve nomally handles only seveal thousand uses. Secondly, highe values of b incease the isk of being detected fo the bots. We will next design a moe esilient stuctue to povide the above epsilon-delta guaantee. C. The extacto-based CRESTBOT design A (w, )-extacto is a bipatite gaph H =(L R, E) with left pat L = M w and ight pat R = y, suchthatevey subset of at least w left vetices has at least (1 )y neighbos on the ight. It is known that, fo any and any w M, thee exist (w, )-extactos in which all left vetices have degee d = Θ(log M), y = Θ(wd), and the distibution of ight degees ae close to unifom, i.e. of degee Md/y = Θ(M/w) [13]. We now constuct a new esilient stuctue R (Figue 2) as follows: fo i =1,...,c,letG i =(X i Y i ; E i ) be copies Fig. 3. Resiliency of the same (w, )-extacto H. ToconstuctR, we glue togethe the X i -side of G 1,...,G c, i.e. identify vetices in the X i in any one-to-one manne. Let X denote the glued X i, and Y = Y 1 Y c. The souce v has an edge to each vetex in X. Intotal,thevetexsetofR is {v } X Y.The following theoem states the esiliency of this stuctue: Theoem 1: Fix any constant >. Letα> be any constant such that α>p.setw =(1 α)m. Thenwith pobability at least 1 exp( Θ(M)) (i.e. exponentially close to 1), whee M is the total numbe of C&Cs, a (1 )-faction of all bots will emain eachable in the stuctue R. Poof: The impotant point to notice hee is that, by definition of extactos, if less than a (1 )-faction of bots ae eachable, then moe than M w = αm C&Cs ae down. Let S be the numbe of unavailable C&Cs, then, noting that E[S] =Mp, Pob[less than (1 )N bots eachable] Pob[S >αm] h ³ i = Pob S> 1+ α p p p M exp M(α p ) 2 /(3p ) ª Figue 3 plots the esiliency of a topology R fo M = 2,N =6with vaious ight degee value b = Md N.Hee the coesponding atios of alive bots ae computed using the wost case value. At b =1, R degades back to the taditional topology whee p is invesely popotional to the atio of the emained bots. As b inceases, the impact of p is educed exponentially. In paticula, fo b =, when 8% C&Cs ae down, only 3% of bots ae affected, compaed to 8% of the taditional topology. At b =7, moe than 9% of the bots ae still eachable even when up to 7% of the C&C ae down. IV. A NEW CLASS OF UDP BOTNET We define CRESTBOT (C&C-based RESilienT Botnets) as a family of botnets using the above topology constuction. The existence of esilient topologies give ise to a potential class of CRESTBOT using UDP as the undelying tansmission potocol. UDP CRESTBOT employ esilient topologies to compensate any potential loss caused by using UDP. UDP offes /8/$2. 28 IEEE. 3

4 two poweful weapons: speed and flow stealth against defense systems, especially those elying on stable flow infomation [11]. We name such botnets as UCRESTBOT. In the following sections, we will evaluate and compae the boadcast time of UCRESTBOT with that of a tadition TCP botnet. The boadcast time is defined as the amount of time fom when the botmaste sends the fist bit of a message until the last bit of that message disappeas fom the netwok. 1) Lossless Tansmission: To simplify the estimation, we conside the case when the bandwidth of each link is unifom, denoted as. We also assume the latency of all links in each laye (between the botmaste and C&Cs, between C&Cs and bots) ae the same, denoted as L 1,L 2 espectively. Denote the length of a message as m, and denote the message boadcast time as T UCRES. Each C&C can send any message to its subscibed bots in a consecutive manne without little o no delay between each tansmission. The following lemma states the expected message boadcast time of UCRESTBOT. Lemma 2: Let Q = m + L p. The expected boadcast time of a UCRESTBOT can be appoximated as: E[T UCRES]=Q M + p(pm 1) 1 p +(1 p M )(dq + L 1 + L 2). (1) Hee d is the left degee of each C&C as defined in the pevious section, L p is the pocessing delay at each node. Poof: Let x I be the last C&C that emains at the second laye. I is a andom vaiable with pobability Pob[I = j] = p M j (1 p ).DenoteZ I as the time the last bot connected to x I eceives the( message. The boadcast time of UCRESTBOT Z I if I>, is: T UCRES =.Wethenhave: Z =, I = E[T UCRES]= = = Q MX Z I Pob[I = j] j=1 MX (j.q + d.q + L 1 + L 2)p M j (1 p ) j=1 M + p(pm 1) 1 p +(1 p M )(dq + L 1 + L 2 ) (2) We now compute the boadcast time fo a TCP botnet using the taditional topology, denoted as T TCP.Ingeneal, the oveall end-to-end delay fo a TCP link is dependent of the specific featues of the undelying TCP stack such as window size, acknowledgment method, congestion contol algoithm etc. Howeve, we obseve that most bot commands ae shot (less than a few hunded bytes) thus can fit ina tansmission window o even in one data segment. Since we ae not consideing packet loss, a single message end-to-end delay will consist mainly of one diection popagation delay and the Round Tip Time fo the connection setup. In addition, we assume that the C&C seves can multiplex simultaneous connections duing the connection setup (e.g by using multiple theads,acommontechniqueusedbymanywoms)toeduce the waiting time. The esult in the pevious lemma can then be modified to compute the message boadcast time fo a taditional TCP botnet: Lemma 3: Define Q as befoe. The expected popagation time fo TCP is: E[T TCP ]=Q M + p(pm 1) 1 p +(1 p M )(dq +3L 1 +3L 2 ). Note the coefficient 3 associated with each L 1,L 2 tem come fom the thee way handshake pocess in TCP. 2) Lossy Tansmission: Denote p e as the packet loss ate on each link. Since UDP povides no etansmission, the endto-end delay fo each successful connection emains the same. The new expected boadcast time of CRESTBOT can then simply be uppe bounded (it can be smalle when thee s no tansmission at the second laye) as in (1),(3) with a new failue pobability p a = p e + p p e p. The delay fo TCP botnet howeve is faily complicated. We boow the well established TCP model in [14] to estimate the delay of a shot TCP connection. The expected delay of a shot TCP connection ove a link with latency L is modeled as: E[T con(l)] = E[L h ]+E[T ss]+e[t loss ]+E[T ca]+e[t delack ] (4) whee E[L h ],E[T ss ],E[T loss ],E[T ca ] and E[T delack ] ae the expected value of handshake, slow stat, etansmission timeouts o fast ecovey, emaining data tansmission, and delayed acknowledgment time espectively. The exact fomula of each tem can be found in [14]. The expected time fo TCP can then be lowe bounded as: E[T TCP (p e )] > (1 p M ){T TCP (L 1 )(1 p e )+p e E[T con (L 1 )]} +(1 p M ){T TCP(L 2)(1 p e) d +[1 (1 p e) d ]E[T con(l 2)]} () whee T TCP (L) = M +3L is the appoximated delay of a shot TCP link with latency L when thee is no packet loss. V. EXPERIMENT To evaluate the accuacy of ou estimation, we conducted extensive expeiments on Emulab []. Emulab is a netwok testbed that offes ealistic expeiments with both actual hadwae and softwae platfoms. Compaed to taditional simulation methods, Emulab povides a testing envionment with much highe fidelity to the eal wold. A. Expeiment Setup Inpactice,theeffectivesize(thenumbeoflivebots)foa botnet is just aound seveal thousands, as pointed out by Rajab et al [9]. Howeve, Cooke [] noted that botnets of size a few hundeds ae also common because they ae difficult to detect and easie to sell o ent. We hence conside two small botnets of size 3 and 6, with 1 and 2 C&Cs espectively. Note that in this setting a C&C contols 3 bots on aveage. Fo this setting, the set of C&Cs is oughly 3% of the bot population (Wang s esilient topology [3] equies 2%). In the next pats of this section, we will efe to these botnets as Bot3 and Bot6. Fo the physical netwok topology, we used BRITE [16], a univesal topology geneato designed to synthesize ealistic netwok topologies. BRITE suppots multiple geneation (3) /8/$2. 28 IEEE. 4

5 Agent Management Expeiment Data Collection Message Boadcast Time (s) Message Boadcast Time (s) 2 1 Emulab Inteface C&C/Bot Agents (a) Expeiment Setup Physical Topology Estimated and Actual Boadcast Time, Bot3 Estimated TCP Time using Max Latencies Estimated TCP Time using Aveage Latencies Actual TCP Time Estimated UDP Time using Max Latencies Estimated UDP Time using Aveage Latencies Actual UDP Time C&C/Bot Agents BotMaste Agent Configuations (b) Estimated and Actual Boadcast Time, Bot3 Estimated and Actual Boadcast Time, Bot6 standad topology Estimated TCP Time using Max. Latencies Estimated TCP Time using Aveage Latencies Actual TCP Time Estimated UDP Time using Max. Latencies Estimated UDP Time using Aveage Latencies Actual UDP Time Configuations (c) Estimated and Actual Boadcast Time, Bot6 Fig. 4. Expeiment setup and esults models fo flat AS, flat Route and hieachical topologies. In each topology geneated by BRITE, nodes ae gouped into multiple ASes and communicate though inte-as links, which ae geneated in esemblance to thei Intenet countepats. Figue 4(a) illustates the setup of ou expeiment. We developed special C&C and Bot agents to simulate C&C and Bot s communication activities. The agents ae andomly distibuted on diffeent machines to simulate the vaiation of netwok topologies. Fo each ound, the Agent Management Component fist deploys agents following the esilient ovelay topology, then instucts BotMaste Agent to send commands to C&C Agents, which in tun fowad the commands to the Bots. Afte each ound, expeiment logs ae collected fom C&C and Bot Agents by the Data Collection Component. B. Results We fist validate the equations (1),(3) established in the pevious section. Recall that we assumed unifom bandwidth and latency on all the links between the botmaste and the C&Cs, as well as between the C&Cs and the bots. Since these assumptions aely hold in pactice, one can elax them by using the aveage values (computed ove all latencies at each laye). Howeve, ou expeiment esults show that it can lead to undeestimation when the latencies vaies widely and the boadcast time can be dominated by the lagest latencies at each level. As can be seen fom Figue 4(b,c), estimated boadcast time using aveage latency values is significantly smalle than the actual time. On the othe hand, estimation using the maximum values yields vey close esults. This holds tue fo both Bot3 and Bot6. We next validate the estimated (using maximum latencies) and actual boadcast time fo a TCP botnet with taditional topology and UCRESTBOT. We use a Bot3 fo the expeiment and use L p = 4 ms fo ou estimation. Figue (a) shows the estimated and actual time fo these botnets. It can be seen that UCRESTBOT boadcast time is only one thid of the countepat in a taditional TCP botnet. We also validate the estimation of UCRESTBOT in the fomula (1) when p vaies. Figue (b) shows the estimated and actual atio E[T UCRESTBOT ] when p vaies ove the case when p =. It can be seen that the actual atio decease much faste than the estimated atio using (1) and the estimated atio is not accuate. Upon close examination of Emulab mechanism, we obseve that L p on Emulab depends on the numbe of netwok connections and thus on p almost linealy. Afte adjusting L p by a facto of 1 p, the estimated atio becomes vey close to the actual esult. Fo lossy conditions, we fist an expeiments on Emulab using the packet loss simulation povided by Emulab. Howeve, the data collected showed abnomal delay compaed to existing TCP models in liteatue. Fo example, Figue (c) shows the gap between the aveage single connection delay at the fist laye of a taditional TCP Botnet3 and its estimated value accoding to [14]. This additional delay is due to the exta pocessing delay incued by the packet loss simulation in Emulab. This delay howeve does not appea unde a lighte packet loss simulation setup. To confim this, we measued the TCP connection delay between 2 machines unning FeeBSD, connected by a diect link with bandwidth 1Mbps, popagation latency 6ms. Figue 6(a) shows the actual and estimated TCP delay unde this setup. It can be seen that the model in [14] agees closely with the actual esults. Finally, Figue 6(b) shows the atio between a TCP Bot3 and UCRESTBOT Bot3 boadcast time when the packet loss ate p e vaies, estimated using (). As p e inceases, the atio also inceases almost linealy fom 3 duing the displayed p e ange. As p e eaches highe values, the atio will follow the same tend in Figue 6(a) /8/$2. 28 IEEE.

6 Message Boadcast Time (s) 2 1 Estimated and Actual Boadcast Time, Bot3 Estimated TCP Time using Max. Latencies Actual TCP Time Estimated CestBot(UDP) using Max. Time Actual UDP Time Res Topo Configuations Ratio Estimated and Actual Popagation Boadcast Time Ratio.6 Actual Ratio.6 Simple Estimated Ratio Adjusted Estimated Ratio C&C Removal Pobability Time(s) Estimated and Actual Boadcast Time fo A Taditional TCP Botnet 2 Estimated Time Actual Time Packet Loss Pobability (a) Taditional and UCRESTBOT Boadcast Time (b) Actual, Estimated Time Ratio of UCRESTBOT (c) Actual and Estimated TCP Delay Fig.. Message boadcast time and delay validation Latency(s) TCP Delay (Single Connection) Compaison Estimated Measued Link Loss Pobability (a) Single TCP Connection Delay Validation ated Boadcast Time Ratio of A Taditional TCP Botnet and UCRE 4.4 Ratio Packet Loss Rate (b) Boadcast Time Ratio UCRESTBOT and TCP Bot3 Fig. 6. TCP delay validation and estimated time atio VI. CONCLUSIONS In this pape we pesented a hypothetical family of botnets named CRESTBOT with esilient topologies based on extactos. We showed that CRESTBOT ae able to guaantee a high level of esiliency, yet do not equie substantial modification to the cuent C&C-based stuctues. We also studied a special UDP membe of the CRESTBOT family, UCRESTBOT, capable of sending commands fom the botmaste at least thee times faste than the taditional botnet. UCRESTBOT and CRESTBOT pose consideable challenge to system administatos by thei esiliency. To defense against these botnets, ealy intevention seems to be the only effective method. This is because most bots ae initially setup to connect to some seed C&Cs and thus ae vulneable duing this phase. Ealy detection and emoval of these seeds ae then citical to cipple these botnets. Techniques as discussed in the elated wok section can then be applied accodingly. REFERENCES [1] content/white papes/wp botnet.pdf. [2] Maymounkov and Maziees, Kademlia: A pee-to-pee infomation system based on the XOR metic, in Intenational Wokshop on Peeto-Pee Systems (IPTPS), LNCS, vol.1,22. [3] P. Wang, S. Spaks, and C. C. Zou, An advanced hybid pee-to-pee botnet, Poceedings 27 USENIX Fist wokshop on Hot Topics in Undestanding Botnets, Ap. 27. [4] S. Hooy, N. Linial, and A. Wigdeson, Expande gaphs and thei applications, Bull.Ame.Math.Soc.(N.S.), vol. 43, no. 4, pp (electonic), 26. [] B.White,J.Lepeau,L.Stolle,R.Ricci,S.Guupasad,M.Newbold, M. Hible, C. Bab, and A. Jogleka, An integated expeimental envionment fo distibuted systems and netwoks, in Poc. of the Fifth Symposium on Opeating Systems Design and Implementation. Boston, MA: USENIX Association, Dec. 22, pp [6] Feiling, Holz, and Wicheski, Botnet tacking: Exploing a ootcause methodology to pevent distibuted denial-of-sevice attacks, in ESORICS: Euopean Symposium on Reseach in Compute Secuity. LNCS, Spinge-Velag, 2. [7] M. A. Rajab, J. Zafoss, F. Monose, and A. Tezis, A multifaceted appoach to undestanding the botnet phenomenon, in Intenet Measuement Confeence, J.M.Almeida,V.A.F.Almeida,andP.Bafod, Eds. ACM, 26, pp [8] D. Dagon, C. Zou, and W. Lee, Modeling botnet popagation using time zones, in NDSS. The Intenet Society, 26. [9] M. Rajab, J. Zafoxx, F. Monose, and A. Tezia, My botnet is bigge than yous (maybe, bette than yous), Poceedings 27 USENIX Fist wokshop on Hot Topics in Undestanding Botnets, Ap. 27. [1] J. R. Binkley and S. Singh, An algoithm fo anomaly-based botnet detection, in SRUTI 6: Poceedings of the 2nd confeence on Steps to Reducing Unwanted TafficontheIntenet. Bekeley, CA, USA: USENIX Association, 26. [11] G. Gu, V. Yegneswaan, and Matin, Bothunte: Detecting malwae infection though ids-diven dialog coelation, pp [Online]. Available: [12] J.Gizzad,V.Shama,C.Nunney,B.KangB.,andD.D., Pee-topee botnets: Oveview and case study, Poceedings 26 1st USENIX Wokshop on Hot Topics in Undestanding Botnets, Ap. 27. [13] C.-J. Lu, O. Reingold, S. Vadhan, and A. Wigdeson, Extactos: optimal up to constant factos, in Poceedings of the Thity-Fifth Annual ACM Symposium on Theoy of Computing. New Yok: ACM, 23, pp (electonic). [14] N. Cadwell, S. Savage, and T. Andeson, Modeling tcp latency, INFOCOM 2. Nineteenth Annual Joint Confeence of the IEEE Compute and Communications Societies. Poceedings. IEEE, vol.3, pp vol.3, 26-3 Ma 2. [] E. Cooke, F. Jahanian, and D. Mcpheson, The zombie oundup: Undestanding, detecting, and disupting botnetns, in Wokshop on Steps to Reducing Unwanted Taffic ontheintenet(sruti), June 2, pp [16] A. Medina, A. Lakhina, I. Matta, and J. Byes, BRITE: an appoach to univesal topology geneation, in Modeling, Analysis and Simulation of Compute and Telecommunication Systems, 21. Poceedings. Ninth Intenational Symposium on, Cincinnati, OH, USA, 21, pp /8/$2. 28 IEEE. 6