Botnet Tutorial.pdf
Version AHosted on compromised webservers running an nginx proxy on port 8080 TCPforwarding all botnet traffic to a tier 2 proxy node. Botnet traffic usuallydirectly hits these hosts on port 8080 TCP without using a domain name.
Botnet Tutorial.pdf
Version BHosted on servers rented and operated by cybercriminals for the exclusivepurpose of hosting a Feodo botnet controller. Usually taking advantage of adomain name within ccTLD .ru. Botnet traffic usually hits these domain namesusing port 80 TCP.
Version CSuccessor of Feodo, completely different code. Hosted on the same botnetinfrastructure as Version A (compromised webservers, nginx on port 8080 TCPor port 7779 TCP, no domain names) but using a different URL structure.This Version is also known as Geodo and Emotet.
The words "robot" and "network" together give rise to the term Botnet. Botnet refers to a network of hijacked internet-connected devices that are installed with malicious codes known as malware. Each of these infected devices is known as Bots, and a hacker/cybercriminal known as the "Bot herder" remotely controls them. A bot is also called a zombie, and a botnet is referred to as a zombie army.
The bot herder can direct every bot to carry out a coordinated illegal action from a single central location. A botnet can have several bots and thus allows the attacker to carry out large-scale attacks. Infected devices can acquire updates and modify their behavior easily and quickly since a remote attacker controls them. The bots are used to automate large-scale attacks, including data theft, server failure, malware propagation, spam email generation, and malicious traffic generation for distributed denial-of-service (DDoS) attacks.
A botnet architecture has developed over a while for improved working and slimmer chances of getting traced. As seen previously, once it infects the desired number of devices, the botmaster (bot herder) takes control of the bots using two different approaches.
In the P2P botnet approach, the infected devices scan for malicious websites or other devices. The bot carefully probes random IP addresses until it comes in contact with another infected machine. The bots then share updated commands or the latest versions of the malware.
Now that you have understood how a botnet works, you can imagine how dangerous it can be. The networks of enslaved devices are behind various dangerous cyber attacks. You will now look at a few sophisticated botnets.
Emerged in 2009, the Mariposa botnet committed online scams and launch DDoS assaults. It was also stealing personal account credentials from victims so that its operators could sell them on the Dark Web.
Those were a few of the destructive and dangerous botnets in history. So, heading to the next section of this tutorial on what is a botnet, you will learn how to protect yourself from a botnet attack.
You require an all-inclusive strategy ranging from good surfing habits to software updates to anti-virus protection to prevent botnet infection. Listed below are some essential methods to keep botnets away.
In this tutorial on what is a botnet, you understood what a botnet is and how it works; you also learned its architecture. You had a look at the different types of botnets and how you can protect yourself from them.
Botnets are connected computers that perform a number of repetitive tasks to keep websites going. Connected devices play an important role in modern life. From smart home appliances, computers, coffee machines, and cameras, to connected cars, this huge shift in our lifestyles has made our lives easier. Unfortunately, these exposed devices could be easily targeted by attackers and cybercriminals who could use them later to enable larger-scale attacks. Security vendors provide many solutions and products to defend against botnets, but in this tutorial, we are going to learn how to build novel botnet detection systems with Python and machine learning techniques.
Many educational institutions and organizations are given a set of collected datasets from internal laboratories. One of the most well known botnet datasets is called the CTU-13 dataset. It is a labeled dataset with botnet, normal, and background traffic delivered by CTU University, Czech Republic. During their work, they tried to capture real botnet traffic mixed with normal traffic and background traffic. To download the dataset and check out more information about it, you can visit the following link: -ctu-13-dataset-a-labeled-dataset-with-botnet-normal-and-background-traffic.html.
I will call the first script DataPreparation.py. There are many proposals done to help extract the features and prepare data to build botnet detectors using machine learning. In our case, I customized two new scripts inspired by the data loading scripts built by NagabhushanS:
In the previous sections, we saw how to build a machine learning-based botnet detector. In this new project, we are going to deal with a different problem instead of defending against botnet malware. We are going to detect Twitter bots because they are also dangerous and can perform malicious actions. For the model, we are going to use the NYU Tandon Spring 2017 Machine Learning Competition: Twitter Bot classification dataset. You can download it from this link: -bot-classification/data. Import the required Python packages:
This technique is not the only possible way to detect botnets. Researchers have proposed many other models based on different machine learning algorithms, such as Linear SVM and decision trees. All these techniques have an accuracy of 90%. Most studies showed that feature engineering was a key contributor to improving machine learning models.
Several chapters are devoted to various aspects of botnet structure and operation. One chapter discusses how botnets can be used to compromise online commerce. Others describe potential methods for detecting botnets using network traffic analysis. Particularly interesting is the chapter that discusses the management techniques that botmasters typically use to control their bots and how the network trail left by them can be used to detect the presence of bots. The main themes of the book are the analysis of typical network traffic patterns of botnets and how traffic characteristics can be used in detection. Each chapter ends with a thorough bibliography.
The Internet of Things (IoT) has grown rapidly, and nowadays, it is exploited by cyber attacks on IoT devices. An accurate system to identify malicious attacks on the IoT environment has become very important for minimizing security risks on IoT devices. Botnet attacks are among the most serious and widespread attacks, and they threaten IoT devices. Motionless IoT devices have a security weakness due to lack of sufficient memory and computation results for a security platform. In addition, numerous existing systems present themselves for finding unknown patterns from IoT networks to improve security. In this study, hybrid deep learning, a convolutional neural network and long short-term memory (CNN-LSTM) algorithm, was proposed to detect botnet attacks, namely, BASHLITE and Mirai, on nine commercial IoT devices. Extensive empirical research was performed by employing a real N-BaIoT dataset extracted from a real system, including benign and malicious patterns. The experimental results exposed the superiority of the CNN-LSTM model with accuracies of 90.88% and 88.61% in detecting botnet attacks from doorbells (Danminin and Ennio brands), whereas the proposed system achieved good accuracy (88.53%) in identifying botnet attacks from thermostat devices. The accuracies of the proposed system in detecting botnet attacks from security cameras were 87.19%, 89.23%, 87.76%, and 89.64%, with respect to accuracy metrics. Overall, the CNN-LSTM model was successful in detecting botnet attacks from various IoT devices with optimal accuracy.
In this research, we present the convolutional neural network and long short-term memory (CNN-LSTM) model to detect botnet attacks from selected IoT devices. The proposed system differs from existing systems by training full datasets. Most researchers have used feature selection to select the most significant features for improving accuracy, but our system has achieved better accuracy by using all the training data. The main innovations of this study are as follows:(a)Using advanced artificial intelligence algorithms such as CNN-LSTM to detect serious botnet attacks against the nine IoT devices infection by ten attacks(b)The proposed system has attained good accuracy by training all input samples(c)The system has the ability to analyze large amounts of data with good accuracy(d)CNN-LSTM has the ability to detect any botnet attack from any IoT device
Numerous researchers have focused on developing efficient frameworks to detect botnet attacks and protect the IoT environment. However, botnet attacks represent most of the DDoS attacks that infect IoT devices. The intrusion detection system is a powerful mechanism that is used to protect network systems against any malicious activities. The proposed system can help detect new attack batching by matching with signature attacks. Intrusion detection has two main methods, anomaly-based detection and signature-based detection, that detect attacks by extracting unknown patterns from network datasets.
An IoT malware attack is a DDoS that attacks IoT devices. Most of the IoT environment does not have any mechanism for automatic updation of the devices themselves; therefore, these attacks cause widespread malware. Setting up an IDS has become very necessary for protection against malware. HaddadPajouh et al. [23] used the long short-term memory (LSTM) classifier to detect malware attacks based on the IoT infrastructure. The authors used 100 samples of malware as training data. The accuracy of the system has reached up to 97%. McDermott et al. [25] suggested deep learning approaches to detect botnet attacks. The Mirai botnet was classified in the research study. Bidirectional long short-term memory (BLSTM) using recurrent neural network (RNN) models was considered as an appropriate approach for protecting systems against botnet attacks. The performance of LSTM has an accuracy of 99.51%, and BLSTM accuracy is 99.98%. Brun et al. [26] applied dense RNN to detect attacks. This system has the ability to detect various types of attacks, such as UDP flooding, TCP SYN flooding, sleep-deprivation attacks, barrage attacks, and broadcast attacks. Captured packets extract statistical sequence data. This study was developed in a 3G SIM card environment, with a lot of IoT devices connected to this network. Meidan et al. [27] employed packet-captured data from IoT devices; the environments of the IoT were a security camera, smoke detector, socket, thermostat, TV, and a watch. The random forest tree algorithm was suggested to detect unauthorized IoT devices; since then, the proposed system obtained a metric of 94% with respect to accuracy. Doshi et al. [28] proposed KNN, a Lagrangian support vector machine (LSVM), decision tree (DT), random forest (RF), and neural network (NN) to predict denial-of-service (DoS) attacks from IoT traffic. The network feature was divided into stateless and stateful features: stateless features include packet size and protocol features, whereas the stateful features include bandwidth and packet headers, such as source and destination address. Hodo et al. [29] applied artificial neural network (ANN) algorithms to detect DDoS/DoS attacks based on the characteristics of host-based IDS and network-based IDS. The proposed system has obtained 99.4% accuracy. 041b061a72