Military Communications and Information Technology: A Trusted ...

402 Military Communications and Information Technology...
V. Network layer observation of future botnets
In this section, we analyse the properties that will remain observable given
the expected design of future botnets discussed in section IV. We start with describing
the properties that remain directly observable in section V.A, followed by
an analysis of how the behaviour of applications correlates with them. Finally, we
motivate a granularity below traditional netflows as the base for further analysis
and ultimately detection in section V.C.
A. Observable features
While OSI layer 2 is persistent in local networks only, i.e. its header does not
contain any information written by the source of a layer 3 packet unless the point
of observation is within the very same local network, we can learn the size of its
payload and the observation time from it. The former will be equal to the size
of the layer 3 packet transmitted by the source unless layer 3 fragmentation occurs.
We suggest however to disregard this special case and treat fragments of a packet
as if they were individual packets sent with the observed size.
For the latter, i.e. the observation time, a simple relation to the timestamp t source
at which an observed packet was transmitted by the source holds. With m denoting
the mean time needed for traversing the links until reaching the observation point
and j the jitter introduced by differences in network load and routes, we can characterise
an observation timestamp t as:
t = t source + m + j
Thus, while we cannot determine t source exactly without knowing m and j, we
can infer that the delay between two consecutive observations differs from the delay
at the source only by the differences of the jitter applied to these observations. I.e.
the smaller j in the equation given above, the better we can approximate that delay
by observing the delay at our observation point.
Based on the analysis provided in section IV, we assume that headers at layer 3
and 4 will generally be genuine, but at least allow associating observed packets with
a particular flow. Note that forged source addresses, where possible, may serve to
complicate attribution but would not impede with gathering and attributing data
for the destination system.
Our analysis further suggests that while OSI layer 5 and up data may be available
technically, it will not contain exploitable features due to the combination
of proper encryption and tunnelling through legitimate protocols. Note that with
what we would call “not proper encryption”, using payload signatures may still be
possible, as pointed out in [5].