[Paper Review] I Trust my Zombies: A Trust-enabled Botnet

Emmanouil Vasilomanolakis, Jan Wolf+3 more|TUbilio (Technical University of Darmstadt)|Dec 11, 2017

Network Security and Intrusion Detection12 references3 citations

TL;DR

This paper proposes a trust-based mechanism for decentralized botnets that enables infected machines (zombies) to autonomously detect and blacklist monitoring sensors using computational trust models. By leveraging Bayesian inference and trust metrics inspired by the eBay model, the system reduces sensor popularity by over 97% compared to traditional P2P botnets, significantly enhancing resilience against detection and intelligence gathering.

ABSTRACT

Defending against botnets has always been a cat and mouse game. Cyber-security researchers and government agencies attempt to detect and take down botnets by playing the role of the cat. In this context, a lot of work has been done towards reverse engineering certain variants of malware families as well as understanding the network protocols of botnets to identify their weaknesses (if any) and exploit them. While this is necessary, such an approach offers the botmasters the ability to quickly counteract the defenders by simply performing small changes in their arsenals. We attempt a different approach by actually taking the role of the Botmaster, to eventually anticipate his behavior. That said, in this paper, we present a novel computational trust mechanism for fully distributed botnets that allows for a resilient and stealthy management of the infected machines (zombies). We exploit the highly researched area of computational trust to create an autonomous mechanism that ensures the avoidance of common botnet tracking mechanisms such as sensors and crawlers. In our futuristic botnet, zombies are both smart and cautious. They are cautious in the sense that they are careful with whom they communicate with. Moreover, they are smart enough to learn from their experiences and infer whether their fellow zombies are indeed who they claim to be and not government agencies' spies. We study different computational trust models, mainly based on Bayesian inference, to evaluate their advantages and disadvantages in the context of a distributed botnet. Furthermore, we show, via our experimental results, that our approach is significantly stronger than any technique that has been seen in botnets to date.

Motivation & Objective

• To address the growing challenge of detecting and mitigating monitoring efforts by researchers and law enforcement on P2P botnets.
• To develop a resilient, decentralized botnet management system that avoids reliance on centralized C2 infrastructure and its associated single points of failure.
• To enable zombies to autonomously assess the trustworthiness of peers and identify potential sensors or crawlers based on behavioral evidence.
• To evaluate the effectiveness of computational trust models in reducing the visibility and success of monitoring tools in P2P botnets.
• To demonstrate that trust-based mechanisms offer a superior alternative to existing graph-theoretic or protocol-anomaly-based anti-monitoring techniques.

Proposed method

• Introduces a computational trust model based on Bayesian inference to evaluate the trustworthiness of neighboring bots in a P2P botnet.
• Uses a neighborlist (NL) mechanism where bots periodically exchange hello messages to maintain connectivity and verify peer legitimacy.
• Employs a reputation system where each bot maintains a trust score based on observed behavior, such as response consistency and message authenticity.
• Applies the eBay-inspired trust model to quantify and update trust values dynamically, enabling bots to detect and isolate suspicious nodes.
• Implements a blacklisting mechanism that removes untrusted peers from the neighborlist to prevent communication with sensors.
• Uses a membership management (MM) cycle to periodically probe neighbors and replace unresponsive or untrusted nodes with verified ones.

Experimental results

Research questions

• RQ1 Can computational trust models effectively distinguish between legitimate bots and monitoring sensors in a P2P botnet environment?
• RQ2 How does the integration of Bayesian inference improve the detection of sensor nodes compared to traditional protocol-level anomaly detection?
• RQ3 To what extent can trust-based mechanisms reduce the visibility and effectiveness of sensors deployed by researchers or law enforcement?
• RQ4 How does the proposed system perform under realistic churn and adversarial conditions in a simulated botnet environment?
• RQ5 What is the impact of different trust models (e.g., eBay vs. basic reputation) on sensor detection accuracy and botnet resilience?

Key findings

• The proposed trust-based mechanism reduced sensor popularity by over 97% compared to the original Sality botnet protocol, significantly limiting researchers' ability to gather network intelligence.
• The eBay-inspired trust model outperformed basic reputation systems in detecting and isolating sensor nodes due to its ability to model uncertainty and update beliefs based on new evidence.
• Computational trust enabled autonomous, decentralized peer validation without relying on centralized control or pre-defined signatures.
• The system demonstrated resilience against sensor deployment, even under high churn and adversarial probing, by dynamically updating trust scores based on behavioral consistency.
• The results suggest that trust-based mechanisms represent a significant advancement over existing anti-monitoring techniques, which are increasingly evaded by such adaptive defenses.
• The study highlights the urgent need for new, stealthier monitoring techniques, as traditional sensor-based approaches become ineffective against such resilient, trust-aware botnets.