Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
397
sue commands to an infected system. While such a channel could use a different
medium in theory, we further narrow this definition down to such botnets where
the C 2 channel is implemented using the Internet or a similar wide area network.
This is the case for all botnets deployed for commercial purposes and, while apparently
designed to bridge an air-gapped system, even the Stuxnet malware provided
an Internet-based C 2 channel [2]. We will use the term bot herder when referring
to the group or individual controlling a botnet, without any further implications
on how or why the herder acquired control over the botnet.
III. Related literature
Detecting botnets can be considered a special case of network-based intrusion
detection. The most prominent examples in that field are Bro, first presented
in [3], and Snort [4]. While allowing different levels of complexity for defining
signatures, both are focused on discovering known malicious packet payloads
described by the user. To some extent, an administrator with deep insight into
the environment and applications she or he supervises may define signatures that
describe abusive behaviour but generally this technique can only be used when
the payload generated by a particular piece of malicious software is known to
the user. [5] alleviates this requirement by introducing a system that is able to
generate signatures from malware communication patterns learned from repeatedly
executing a sample in a secure environment. However, in order to be able to
generate a signature, an infection has to be detected and a sample of the malware
be obtained first.
Gu et al. follow a different approach [6], collecting data for each system in two
domains, one for netflow data and another one for malicious activities. They then
cluster data in each of these domains individually and treat co-occurrences of hosts
in activity and netflow clusters as an indicator for those hosts being part of a botnet.
While this eliminates the requirement for obtaining a sample for a malware, obtaining
data for malicious activity requires the ability to detect such activity. I.e. while
their approach shifts the focus, it will still work only when the attacks a botnet will
carry out have been analysed and described appropriately before.
The authors of [7] introduce an approach which measures several features
for each observed flow. Based on their assumption that these features are normally
distributed, they are able to assign an anomaly score to a measurement and visualise
the expectation and actual measurement for a system. In contrast to the approaches
described above, this does not require any knowledge of a malware that
should be detected, but requires that both the distribution for an observed feature
is Gaussian and that it will be affected by the malware’s traffic. Thus, feature selection
is a critical element, as underlined by the author’s statement that for features
with a distribution not fit well by a Gaussian curve, the accuracy of their approach
was not satisfying.