Military Communications and Information Technology: A Trusted ...

412 Military Communications and Information Technology...
in higher level fusion of multiple information sources for a general detection of bot
behaviour in network traffic.
B. Guide railing features
In section IV, we discussed the expected design for future botnets, focusing on
the most promising approaches from a bot herder’s point of view and then described
an approach for detecting botnets following the implied design principles. We are
aware however, that a protocol may be designed particularly to evade approaches
as the one presented in this publication, e.g. by using oversized transport headers
for messaging to simulate packets without any application payload. As pointed
out in section IV.B, this would constitute a more striking anomaly than the ones
we aim to detect with the described features, but could nevertheless reach the goal
of evading detection in the described feature space. For a practical deployment, our
model should thus include additional features that indicate such evasive behaviour,
i.e. provide strong evidence of malicious activity.
C. Signatures
As pointed out in section VII, legitimate applications may to some degree
exhibit the behaviour associated with botnet clients. To avoid false alarms without
allowing botnets with a loose C 2 channel to go undetected, it may be helpful to allow
incorporating signatures matching the behaviour of these applications regarding
our feature space so that the measurements they generate can be filtered.
X. Conclusions
In this paper, we discussed key elements of the botnet design which is likely to
emerge from their ongoing evolution. Our analysis suggests that future botnets will
use proper encryption and integrity checks for their protocol messages and authentication
for commands and updates. Those measures, potentially complemented by
tunnelling through legitimate protocols, would render them invisible to payload based
approaches currently dominant in network intrusion detection. Based on careful
analysis of the relationship between properties that remain observable to a network
intrusion detection system under these circumstances and the behaviour of applications
communicating through a network, we suggested to observe the delay between
flow initiations to a similar protocol endpoint, the count of failed flow initiations
and the count of payload bytes transferred for botnet detection. We drafted a system
which exploits the measurement of these and possibly additional features as an input
to an iterative likelihood ratio test for assigning one of three classes of hosts to each
observed system. These classes include a model for hosts that have been infected
with a botnet client, i.e. the classification reveals a malware infection.