Reporter: 高嘉男 Advisor: Chin-Laung Lei 2009/12/07

1. A First Step towards Live Botmaster TracebackDaniel Ramsbrock, Xinyuan Wang, and Xuxian Jiang- the 11th International Symposium on Recent Advances in Intrusion Detection (RAID 08), 2008. Reporter: 高嘉男 Advisor: Chin-Laung Lei 2009/12/07 1

2. Outline • Introduction • Four challenges of tracking the botmaster • Botmaster traceback model • Length-based watermarking scheme • Basic length-based watermarking scheme • Hybrid length-timing watermarking for encrypted traffic • Implementation and experiment • Conclusion

3. Four Challenges of Tracking the Botmaster • Botmaster does not directly connect to the C&C server • Low traffic volume between bot & botmaster • Encryption • Flow mixing

4. Tracking the Botmaster by Watermarking Botnet Traffic

5. Basic Length-based Watermarking Scheme - Watermark Bit Encoding • Notation: • f : packet flow of n packets P1, …, Pn • -bit watermark W : w0, … , wl-1 • packet pairs: • : reference packet: encoding packet • lr , le: packet lengths of encoding packet & reference packet • L : bucket size • Assign watermark bit wkinto • Encoding function

6. Watermark Bit Decoding • Decoding function • Decode the watermark bit

7. Watermark Collision Probability (False Positive Rate) • Error tolerance • f contains watermark W if • Watermark collision • Watermark W is found in an unwatermarked flow • Collision probability • Experiment: decode 1,000 unwatermarked flows • Choose h = 4 • False positive rate = 9.64 x 10-6

8. Watermark Collision Probability and Distribution

9. Hybrid Length-Timing Watermarking for Encrypted Traffic • Chaff messages • Unwatermarked messages from other bots • Unencrypted traffic • Encrypted traffic • Send encoding packets at a specific time • Assume the network jitter δ is limited • Packets used for decoding :

10. Implementation of Length-Only Algorithm (Unencrypted Traffic)

11. Implementation of Hybrid Length-Timing Algorithm (Encrypted Traffic)

12. Hybrid Length-Timing Algorithm - Encoder & Decoder • Encoder • Packet flow of 64 packets & 32-bit watermark • Time between messages: 2 ~ 2.35 s • Decoder - offset self-synchronization • Determine t1 : time of the first watermarked packet • Start : t1 = offset, incrementing t1 by step until t1 =(offset + max) • Decode the full watermark sequence for each t1 • Record the number of bits matching the watermark W

13. Offset Self-Synchronization

14. Chaff Messages • Five different chaff levels (Chaff 1 to 5) • Chaff 1: time between packets = 1 ~ 2 s • δ = 200 ms • Sliding offset = 0 ~ 10 s

15. Conclusion • It address the four major challenges: • Stepping stones • Encryption • Flow mixing • Low traffic volume between bot & botmaster • It can successfully trace a watermarked flow • False positive rate <= 10-5

16. Reference • Daniel Ramsbrock, Xinyuan Wang, and Xuxian Jiang, “A first step towards live botmaster traceback.”, in the 11th International Symposium on Recent Advances in Intrusion Detection (RAID 08), 2008.