Structured peer-to-peer overlay networks: ideal botnets command and control infrastructures? In: Computer security—ESORICS 2008, pp 461–480

Abstract. Botnets, in particular the Storm botnet, have been garner-ing much attention as vehicles for Internet crime. Storm uses a modified version of Overnet, a structured peer-to-peer (P2P) overlay network pro-tocol, to build its command and control (C&C) infrastructure. In this study, we use simulation to determine whether there are any significant advantages or disadvantages to employing structured P2P overlay net-works for botnet C&C, in comparison to using unstructured P2P net-works or other complex network models. First, we identify some key measures to assess the C&C performance of such infrastructures, and employ these measures to evaluate Overnet, Gnutella (a popular, un-structured P2P overlay network), the Erdős-Rényi random graph model and the Barabási-Albert scale-free network model. Further, we consider the three following disinfection strategies: a) a random strategy that, with effort, can remove randomly selected bots and uses no knowledge of the C&C infrastructure, b) a tree-like strategy where local informa-tion obtained from a disinfected bot (e.g. its peer list) is used to more precisely disinfect new machines, and c) a global strategy, where global information such as the degree of connectivity of bots within the C&C in-frastructure, is used to target bots whose disinfection will have maximum impact. Our study reveals that while Overnet is less robust to random node failures or disinfections than the other infrastructures modelled, it outperforms them in terms of resilience against the targeted disinfec-tion strategies introduced above. In that sense, Storm designers seem to have made a prudent choice! This work underlines the need to better understand how P2P networks are used, and can be used, within the botnet context, with this domain being quite distinct from their more commonplace usages.