Botnets Architectures, Countermeasures, and Challenges

This book provides solid, state-of-the-art contributions from both scientists and practitioners working on botnet detection and analysis, including botnet economics. It presents original theoretical and empirical chapters dealing with both offensive and defensive aspects in this field. Chapters address fundamental theory, current trends and techniques for evading detection, as well as practical experiences concerning detection and defensive strategies for the botnet ecosystem, and include surveys, simulations, practical results, and case studies.

ContentsPreface .......................................................................................................... viiAbout the Editors ...........................................................................................ixContributors...................................................................................................xi1 Botnet Architectures: A State-of-the-Art Review.................................... 1BASHEER AL-DUWAIR AND MOATH JARRAH2 IoT Botnets: The Journey So Far and the Road Ahead........................ 33PASCAL GEENENS3 IoT Botnet Traits and Techniques: A View of the State of the Art .... 101PASCAL GEENENS4 Advanced Information Hiding Techniques for Modern Botnets ....... 165LUCA CAVIGLIONE, WOJCIECH MAZURCZYK, AND STEFFENWENDZEL5 Steganography Techniques for Command and Control(C2) Channels.................................................................................... 189JEDRZEJ BIENIASZ AND KRZYSZTOF SZCZYPIORSKI6 Blockchain-Based Botnets for Command-and-Control Resilience .... 217WEIZHI WANG AND XIAOBO MA7 Detecting Botnets and Unknown Network Attacks inBig Traffic Data ................................................................................. 237LUIS SACRAMENTO, IBÉRIA MEDEIROS, JOÃO BOTA, AND MIGUELCORREIA8 Domain Generation Algorithm Detection Techniques throughNetwork Analysis and Machine Learning .......................................... 269FEDERICA BISIO, SALVATORE SAELI, AND DANILO MASSA9 Identifying IoT-Based Botnets: A Microservice Architecture forIoT Management and Security........................................................... 293THARUN KAMMARA AND MELODY MOH10 Understanding and Detecting Social Botnet.......................................327YUEDE JI AND QIANG LI11 Use of Botnets for Mining Cryptocurrencies ......................................359RENITA MURIMI12 Time to Diverge the Botnet Revenues from Criminal Wallet?............387GIOVANNI BOTTAZZI, GIANLUIGI ME, PIERLUIGI PERRONE, ANDGIUSEPPE GIULIO RUTIGLIANOIndex............................................................................................................403

Dr. Marios Anagnostopoulos received his Ph.D. degree in information andcommunication systems engineering from the Department of Information andCommunication Systems Engineering, University of the Aegean, Greece, in 2016.The title of his doctoral thesis was “DNS as a multipurpose attack vector.”Currently, he is Post-Doctoral Research Fellow in the Norwegian University ofScience and Technology (NTNU). Prior to joining NTNU, he worked as Post-Doctoral Research Fellow in the Singapore University of Technology and Design(SUTD). His research interests are in the fields of network security and privacy,mobile and wireless networks security, cyber-physical security, and blockchain insecurity and privacy.Dr. Georgios Kambourakis received the Ph.D. degree in information and communicationsystems engineering from the Department of Information and CommunicationsSystems Engineering, University of the Aegean, Greece, where he iscurrently an associate professor, and the head of the department. His researchinterests are in the fields of mobile and wireless networks security and privacy. Hehas over 120 refereed publications in the aforementioned fields of study. For moreinformation, please visit http://www.icsd.aegean.gr/gkamb.Dr. Weizhi Meng is currently an assistant professor in the Cyber Security Section,Department of Applied Mathematics and Computer Science, Technical Universityof Denmark (DTU), Denmark. He received his Ph.D. degree in computer sciencefrom the City University of Hong Kong (CityU), China. Prior to joining DTU, heworked as a research scientist in Institute for Infocomm Research, A*Star, Singapore,and as a senior research associate in CS Department, CityU. He won the OutstandingAcademic Performance Award during his doctoral study and is a recipient ofthe Hong Kong Institution of Engineers (HKIE) Outstanding Paper Award forYoung Engineers/Researchers in both 2014 and 2017. He is also a recipient of BestPaper Award from ISPEC 2018 and Best Student Paper Award from NSS 2016. Hisprimary research interests are cyber security and intelligent technology in security,including intrusion detection, smartphone security, biometric authentication, HCIsecurity, trust management, blockchain in security, and malware analysis.Dr. Peng Zhou is currently an associate professor at Shanghai University. He hasreceived his Ph.D. degree from the Hong Kong Polytechnic University andworked as a research fellow in Singapore Nanyang Technological University forone year. His research interests include network security, computer worms andpropagation, and machine learning.