The SIC botnet lifecycle model: A step beyond traditional epidemiological models Accepted Author Manuscript ("AAM") Published in Computer Networks (Elsevier), Special Issue on Botnet Activity: Analysis, Detection and Shutdown, Volume 57, Issue 2, pp. 404–421, DOI: 10.1016/j.comnet.2012.07.020 NOTICE: this is the author's version of a work that was accepted for publication in Computer Networks. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. A definitive version was subsequently published in Computer Networks, [VOL 57, ISSUE 2, (4 February 2013)] DOI 10.1016/j.comnet.2012.07.020
Transcript
The SIC botnet lifecycle model: A step beyondtraditional epidemiological models
Accepted Author Manuscript ("AAM")
Published in Computer Networks (Elsevier), Special Issue on Botnet Activity: Analysis, Detection and Shutdown, Volume 57, Issue 2, pp. 404–421, DOI: 10.1016/j.comnet.2012.07.020
NOTICE: this is the author's version of a work that was accepted for publication in ComputerNetworks. Changes resulting from the publishing process, such as peer review, editing, corrections,structural formatting, and other quality control mechanisms may not be reflected in this document.Changes may have been made to this work since it was submitted for publication. A definitive versionwas subsequently published in Computer Networks, [VOL 57, ISSUE 2, (4 February 2013)] DOI10.1016/j.comnet.2012.07.020
The SIC Botnet Lifecycle Model:A Step Beyond Traditional Epidemiological Models
Masood Khosroshahy, Mustafa K. Mehmet Ali, Dongyu Qiu
Electrical and Computer Engineering Dept., Concordia University, Montreal, Canada
Abstract
Botnets, overlay networks built by cyber criminals from numerous compromised network-accessible devices, have become a press-ing security concern in the Internet world. Availability of accurate mathematical models of population size evolution enablessecurity experts to plan ahead and deploy adequate resources when responding to a growing threat of an emerging botnet. In thispaper, we introduce the Susceptible-Infected-Connected (SIC) botnet model. Prior botnet models are largely the same as the modelsfor the spread of malware among computers and disease among humans. The SIC model possesses some key improvements overearlier models: (1) keeping track of only key node stages (Infected and Connected), hence being applicable to a larger set of botnets;and (2) being a Continuous-Time Markov Chain-based model, it takes into account the stochastic nature of population size evolu-tion. The SIC model helps the security experts with the following two key analyses: (1) estimation of the global botnet size duringits initial appearance based on local measurements; and (2) comparison of botnet mitigation strategies such as disinfection of nodesand attacks on botnet’s Command and Control (C&C) structure. The analysis of the mitigation strategies has been strengthened bythe development of an analytical link between the SIC model and the P2P botnet mitigation strategies. Specifically, one can analyzehow a random sybil attack on a botnet can be fine-tuned based on the insight drawn from the use of the SIC model. We also showthat derived results may be used to model the sudden growth and size fluctuations of real-world botnets.
Botmasters, the cyber criminals behind botnets, leverage awide range of malware vectors to infect network-accessible de-vices, with the majority of the devices being personal comput-ers in homes, businesses, schools, and governments. Once in-fected, these devices (or nodes) form botnets and are remotelycontrolled by the botmasters for illicit activities such as sendinge-mail spam and extortion by threats of launching DistributedDenial-of-Service (DDoS) attacks.
In recent years, the number of infected and remotely con-trolled nodes in each of the major botnets has reached the orderof millions, e.g., the Mariposa botnet has been estimated to have13 million computers across 190 countries [1]. Indicating howmuch botnets are responsible for e-mail spams on the Internet,a single takedown of a rogue ISP which hosted the main infras-tructure of few botnets in November 2008 led to an instant dropof 80% in the level of e-mail spams [2]. In another incident, thecountry of Estonia came under a politically-motivated DDoS at-tack in April 2007 which knocked off critical infrastructure andthe media [3]. The cumulative processing and bandwidth re-sources at the disposal of cyber criminals are therefore enoughto severely attack any entity or temporarily knock entire coun-
tries off the Internet; this has resulted in the designation of bot-nets as a major security threat.
Analytical models may provide significant benefits in thefight against botnets. When either a new botnet threat emergesor an existing botnet goes into a rapid growth period due to anew infection, then there are two main questions that we wouldlike to have answers to. One of them will be the determinationof seriousness of the threat, which requires prediction of thesize of the botnet as a function of time. This will let us knowthe number of nodes that eventually may be compromised. Theother will be to determine the appropriate mix of mitigationstrategies that need to be deployed to stop the growth of thebotnet and possibly reverse it. In both cases, a good analyti-cal model will be helpful if the estimates of its parameters areavailable. As a result of the growing botnet threat, new orga-nizations are emerging that continuously keep track of botnetsand measure their sizes. Thus, it is expected that the estimatesof the model parameters will become available so that analyti-cal models may be used to give answers to the above questions.
To this end, we develop an analytical model tailored tobotnet, its expansion and evolution behaviors. Each Internetnode/host goes through several stages during the lifetime of thebotnet. The stages, and the back-and-forth transition betweenthem, associated with an Internet node that can join a botnetare more complex compared to those of an infected computer(node) which remains isolated. These complex node stage char-acteristics lead to a botnet expansion behavior that cannot be
Preprint submitted to Computer Networks July 18, 2012
explained or predicted using the available analytical models forcomputer malware propagation. Further, as shown in the Re-lated Work section, recent analytical botnet models have notaddressed this issue adequately. In this work, we intend to fillthis gap.
The contribution of this paper is twofold: (1) the SIC bot-net model which captures the key node stages relevant tobotnets; we derive important results such as mean and vari-ance of the number of nodes in different stages based on thismodel; and (2) development of a link between a botnet lifecy-cle/propagation/population model (the SIC model) and mitiga-tion strategies aimed at Distributed Hash Table (DHT)-basedPeer-to-Peer (P2P) botnets; with this analytical link, a securityexpert would be able to evaluate different mitigation strategies(disinfection, Sybil attack, Index Poisoning, etc.) prior to theirimplementation.
The paper is organized as follows: in Section 2, we exam-ine the prior modeling efforts in this domain by introducingand analyzing both stochastic and deterministic botnet mod-els. In Section 3, the SIC model is introduced by describingthe Continuous-Time Markov Chain (CTMC) model as well asjustifying the modeling assumptions. We then present an ex-tensive performance modeling of the SIC Model in Section 4.First, the fundamental probability flow equations resulting fromthe CTMC model are presented. We then proceed to derive themeans, variances, and Basic Reproduction Number of the SICmodel. Afterwards, we introduce the developed link betweenthe SIC model and mitigation strategies aimed at DHT-basedP2P botnets. As a case study, we analyze a random sybil attackon a P2P botnet and examine how the attack can be fine-tunedbased on the information provided by the SIC model. Next, westudy in Section 5 how the results estimated by the SIC modelwould relate to some of the reported botnet size measurements.In Section 6, numerical results are provided showing the kindsof insight that can be drawn from the SIC model based on theaforementioned derived analytical results. Finally, we concludethe paper in Section 7 by providing some final thoughts as wellas mentioning our future work.
2. Related Work
Abstracting away the name of actors in the system to bemodeled, developing analytical models for spread of computervirus, expansion of botnets and disease spread (biology) aresimilar problems. In the past two decades, researchers haveadapted the analytical results from epidemiology to malwarepropagation and, recently, to botnet lifecycle modeling. Welimit, however, the overview in this section to studies regardingbotnet population/lifecycle modeling to ensure that the modelscan be reasonably compared to one another.
In computer science, the term virus was first used in late1980’s to refer to a “self-replicating” code intended to do dam-age. Facing this new phenomenon, [4] was the first studythat suggested the application of epidemiology for studying thepropagation of computer virus. In the course of the two decadesthat followed, numerous other analytical models based on the
same premises were proposed such as [5–8]. Before examiningthe related work, few definitions are due:
Node Stage A node (an arbitrary network-accessible device inthe Internet) can be in either of the stages defined in the an-alytical model (e.g., Susceptible and Infected stages). Withtime, depending on the model, nodes can usually transitionfrom one stage to another. In this paper, we use the termstage in the context of a node and the term state in thecontext of the whole system to avoid confusion; the termi-nology of the cited works has been adapted to be compat-ible with ours. State of the system, therefore, is used toindicate the number of nodes that are in each stage at anygiven time.
Lifecycle Lifecycle indicates the fact that nodes change stagein the lifetime of the botnet. Botnet refers to the nodes thatare in a certain stage, e.g., in the Connected stage in theSIC model. Botnet lifecycle, on the other hand, indicatesthe fact that the botnet itself appears, expands, shrinks, anddisappears, as a collection of nodes that are in a certainstage within the overall system which is the Internet.
2.1. Stochastic vs. Deterministic Modeling
When considering the analytical models, it is importantto consider that every analytical model for botnet expan-sion/lifecycle falls into either of the following two broad cat-egories: deterministic and stochastic. While a deterministicmodel is easy to develop and analyze, it does not allow somecritically important analysis permitted by a stochastic modelwhich is relatively more difficult to construct and analyze.Specifically, the botnet population size is a stochastic processsince dynamics of botnet expansion is probabilistic. In the de-terministic models, the botnet population size is assumed to bea deterministic variable and the arrivals/departures to/from thepopulation are also assumed to have deterministic values. As aresult, the population size as a function of time is governed byan ordinary differential equation which is written in an ad hocmanner. The deterministic models may capture the mean popu-lation size accurately, however, this approach neither gives thedistribution of the population size nor its higher moments. Onthe other hand, increasing the number of node stages causesa stochastic model to become intractable far more quickly incomparison to a deterministic model; therefore, when devel-oping a stochastic model, it becomes imperative to limit thenumber of node stages considered. In what follows, stochasticmodels are introduced first, followed by deterministic ones.
2.1.1. Stochastic ModelsIn [9], the population size of the Storm botnet has been stud-
ied through simulation of a Stochastic Activity Network (SAN)model (a variant of stochastic Petri nets). The SAN model andits parameters have been loosely based on the information gath-ered on the Storm Worm botnet. The SAN models the lifecy-cle of a node with four stages: Susceptible, InitialBotInfection,ConnectedBot, and FullyConnectedBot. It is assumed that thenumber of nodes in the Susceptible stage is infinite and the time
2
interval for a node to move from one stage to the next one inthe last three stages are exponentially distributed with differ-ent parameters. It has been also assumed that the move of anode between stages succeeds with certain probability and un-successful nodes are removed from the experiment. Successprobabilities may be used to account the impact of mitigationstrategies on the growth of the botnet. The paper presents sim-ulation results for the mean population size of nodes in Fully-ConnectedBot stage as a function of time for different successprobabilities between stages. It may be seen that when successprobability is one, the botnet grows exponentially.
[10] has introduced “genetic mechanism” as the topologyconstruction mechanism of botnets. Through this modelingmethod, they study “in-degree distribution”, shortest distance,and clustering coefficient of the constructed topology. Thestudy, however, lacks results regarding botnet size and variousparameters thereof.
[11] investigated P2P botnet topologies using the stochasticMonte Carlo simulation. Under worm infection and user coun-termeasures, the metrics of “number of peers” and “botnet size”have been studied which leads to the determination of robust-ness and effectiveness of the formed P2P botnets. Like [9], theusefulness of this study is limited due to the used simulationenvironment and the study lacks formulas to examine the bot-net size, which in general limits any botnet analysis by a thirdparty.
A probability model to estimate the number of machines in-fected per hour with the Conficker-C worm has been presentedin [12]; the work includes derivation of the distribution of thenumber of hourly UDP connection attempts made by an in-fected host and the conditional distribution of the number ofobserved hits in the monitored IP space. While being a solidanalytical study, this is a one-stage model, i.e., it cannot keeptrack of more than one node stage. An analytical botnet model,however, needs to simultaneously keep track of at least two setsof nodes: (1) nodes which are infected by the initial malware;and (2) the infected nodes which subsequently managed to jointhe botnet.
A schematic diagram representing the movement of nodesbetween several stages was presented in [13] in order to model“botnet propagation.” The study, however, lacks an analyti-cal, simulation, or measurement component, nor does it havean accompanying quantitative or qualitative analysis. It there-fore does not seem possible to evaluate this study in the currentform.
Finally, [14] presented a model of worm’s propagation prob-ability in a P2P overlay network using a fully-connected graph.This model is limited to small networks, however, as having asquare matrix of dimension n, with n being the number of nodesin the network, to define and examine the network topology andbotnet size leads to the model being unusable for Internet-scalescenarios.
2.1.2. Deterministic ModelsInspired by epidemic models, there have been several de-
terministic models proposed in recent years [8, 15–18] basedon ordinary differential equations describing the flow of nodes
from one stage to another; these are briefly described as fol-lows: [15] includes a model for the growth of the presentedP2P botnet which is dependent on the number of target hoststhat can be infected at any one time. [16] extended the clas-sic Susceptible-Infectious-Removed (SIR) model by taking intoaccount the diurnal pattern, i.e., the effect of time zones in mal-ware propagation. It is important to note that the SIC modelproposed in this paper is a model to estimate the botnet foot-print/total size (i.e., not just live/awake nodes) at any giventime; diurnal patterns do not affect botnet footprint/total size.Using the domain name redirection technique to gather data onthe Conficker botnet, [17] customized the SIR epidemic model.[18], on the other hand, analyzes the relationship between thenumber of infected hosts and propagation ratio based on theSIR model, drawing an insight regarding the effects of differentpropagation ratios on botnet scale and stability.
We conclude the Related Work section by introducing andexamining [8], as an example of prior botnet models, as fol-lows: this model assumes finite node population of size N andthe lifecycle of nodes consists of four stages: (1) S stage: sus-ceptible nodes that can become infected; (2) I stage: infectiousnodes that can infect the susceptible nodes; (3) V stage: in-fectious nodes that can infect the susceptible nodes on top ofbeing active in botnet’s illicit activities (nodes autonomouslyand probabilistically change stage between V and I); and (4) Rstage: removed/disinfected nodes that remain immune to all fu-ture infection vectors utilized by the botmasters. The nodes instage V can either transition to stage R with the rate γ or tran-sition back to stage S with the rate ρ. After the derivation ofa system of equations for the rates of change of (normalized)number of nodes in various stages, the authors then proceed topresent some figures regarding the evolution of variable values,focusing in each case on changing a specific parameter; onesuch equation is as follows: ds(t)
dt = −β[i(t) + v(t)]s(t) + ρv(t).The above work has several limitations: (1) this is a deter-
ministic model and does not account for the stochastic natureof botnet node population changes; (2) the analysis only leadsto the mean number of nodes in different stages of node lifecy-cle and higher moments cannot be obtained. Further, the resultsmay only be calculated numerically and no closed form resultsare obtained for the mean values; and (3) in the model, newinfections depend on the number of nodes in Infected stages (Iand V), which is not usually the case in botnets (Infected nodesnot yet part of the botnet are generally not able to cause newinfections, e.g., see [19]).
3. The SIC Model
In this section, we present our botnet lifecycle model andthen develop its mathematical representation. We first introducethe model basics and later elaborate on the main assumptions ofthe model.
3.1. IntroductionAs reported extensively in the literature [9, 20–22], a node,
when infected by a botnet-related malware, goes through mul-tiple stages in the lifetime of the botnet, with the main stages
3
Infected
stage
λ1n2 λ2n1
Connected
stageSusceptible
Nodes: infinite
source
λan2
λr1n1 λr2n2
n2n1
Figure 1: SIC model: 2-dimensional birth-death CTMC
n1-1,n2
n1,n2
n1+1,n2
n1-1,n2+1
n1,n2+1n1,n2-1
n1+1,n2-1
λ1n2
λr1(n1+1)
λr2(n2+1)
λ2(n1+1)
λa(n2+1)
λ1n2
λ2n1
λan2
λr1n1
λr2n2
Figure 2: SIC model: State-transition-rate diagram
being Susceptible, Infected, and Connected. Here are the defi-nitions of these terms, as used in this paper:
Susceptible (S) A node is considered to be in the Susceptiblestage, if it is healthy, whether or not vulnerable. A vul-nerable node can be infected through at least one of thepossibly many infection vectors (worm scans, e-mail at-tachments, etc.) deployed simultaneously or sequentiallyby the botmasters of a single botnet. On the other hand,a node is invulnerable if either it cannot be infected byany infection vector or the address is either unused or un-routable/unreachable. As defined, the Susceptible nodepopulation corresponds to the entire population of the In-ternet. The term Susceptible refers to the fact that untilprobed, one usually cannot determine whether or not thenode is vulnerable. A Susceptible node may either get in-fected with the small probability p and possibly later be-come part of the botnet or remain healthy throughout thewhole period with the large probability of 1− p. All nodesare initially considered to be in the Susceptible stage.
Infected (I) The Infected stage denotes a stage in which a nodehas been infected by any of the infection vectors that havebeen utilized by the botmasters. In this stage, the nodeusually does not have the full malware code to engage in
illicit activities; this is primarily for keeping the payloadsmall. The minimal malware code serves only to connectthe node to the botnet and pass the node to the Connectedstage.
Connected (C) The Connected stage refers to the stage whenthe node is connected to the botnet, can download the fullmalware code and receive the botmasters’ Command &Control (C&C) traffic, and therefore, it is part of the armyof bots controlled by the botmasters.
As we model the lifecycle of a node with the aforemen-tioned three stages, the model is referred to as the Susceptible-Infected-Connected (SIC) model. In Fig. 1, we show the stagesof the model and the transitions between the stages. As shownin the figure, we let n1 and n2 denote the number of nodes in In-fected and Connected stages, respectively, and the state of thesystem is represented by the vector (n1, n2). In Fig. 2, we showall the transitions from and to state (n1, n2).
In this model, we consider that each node in the botnet (nodesin Connected stage) infects one Susceptible node (increases n1by one) with probability λ1∆t + o(∆t) in any ∆t interval (cf.Fig. 1). Thus the time interval for a Connected node to infect aSusceptible node is exponentially distributed with parameter λ1and the transition rate between Susceptible and Infected stagesis given by λ1n2. Further, each Infected node can transitionto Connected stage (which increases n2 and decreases n1) withprobability λ2∆t + o(∆t) in any ∆t interval. Finally, there is atransition rate (λan2) from Connected stage to Infected stage.This transition rate represents an attack on the botnet, attackssuch as index poisoning and sybil attacks in the case of P2Pbotnets. Under such attacks, nodes do not transition back toSusceptible stage; they just lose the ability to communicate andmight be able to reconnect again (hence the rate from Con-nected stage back to Infected stage). We further assume therate of disinfection of nodes which are in Infected stage andConnected stage to be λr1n1 and λr2n2, respectively.
3.2. Model AssumptionsIn this sub-section, we put forward the reasoning behind the
assumptions made in the development of the SIC model. To thebest of our knowledge, these assumptions are reasonable math-ematically as well as consistent with precedence and evidencefrom closely-related phenomena such as malware propagationand spread of human disease.
3.2.1. CTMC (Exponential probability distributions) Modeling
Continuous-time Markov Chain (CTMC) models are basedon the assumption that the time intervals for the transitions ofnodes from one stage to the next one are exponentially dis-tributed with different parameters. In this part, we first pro-vide the mathematical basis for the use of exponential distri-butions and then describe how this assumption is in agreementwith precedence.
A. Mathematical Basis: Each attempt to make a node transi-tion from any stage to another stage is a Bernoulli trial with suc-cess probability of p. We explain how this concept of Bernoulli
4
trial corresponds to physical reality first for the transition fromSusceptible to Infected (S → I) which is the most importanttransition in the model leading to the exponential growth of thenumber of nodes in the Infected and Connected stages. At theend, we briefly explain how the same concept of Bernoulli trialalso corresponds to physical reality for the rest of the transitionsin the SIC model.
Most botnets apply worm-scanning methods to recruit newbots [23]. Further, it has been reported that 66.5% of scan pat-terns are uniform random scanning [24]. To explain the processwith a concrete example, we therefore consider uniform randomscanning as the infection vector used by the botnet node. Usingthe terminology presented in [25], for a uniform scan worm, η isthe average scan rate, i.e., the average number of scans a botnetnode sends out per unit of time. Each scan corresponds to anattempt to infect a susceptible node. If the susceptible node isvulnerable to this specific worm scan, then, it will be infected,otherwise the attack will fail and the node will remain healthy.η is therefore equal to m, which is the number of aforemen-tioned Bernoulli trials. The campaign of a single botnet nodeto infect can then be viewed as a series of Bernoulli trials withfew successes/infections among many failures.
The above series of Bernoulli trials has therefore a Bino-mial distribution with parameters p (success probability) andm (number of Bernoulli trials). A Binomial distribution can beapproximated by a Poisson distribution with parameter λ = mp,when p is small and m is large [26, pp.111-3]. Note that m isdifferent from n1 and n2 which denote the numbers of Infectedand Connected nodes, respectively, however, the λ parameterrefers to λ1 indicated in Fig. 1. The conditions on the values ofm and p are consistent with the S→ I transition, as the successprobability is low and the number of trials is large. Therefore,the probability distribution of the number of nodes making tran-sitions in unit time period can be approximated by this Poissondistribution. Further, as sum of processes each having a Poissondistribution with parameter λ1 also has a Poisson distribution,the whole arrivals into the Infected stage due to all botnet nodesthen have a Poisson distribution with parameter λ1n2. From thePoisson distribution, it follows that the time intervals betweennode arrivals to the Infected stage are exponentially distributed.
As noted at the beginning, we provide a brief explanationregarding how the same concept of Bernoulli trial also corre-sponds to physical reality for the rest of the transitions in theSIC model as follows:
I→ C Each Infected node which has the minimal malwarecode to help it to connect itself to the botnet makes, onaverage, several attempts to either connect to the centralC&C server or find peers in a P2P botnet. As such, wecan designate a success probability of p for the successfulconnection to the botnet for these attempts each of whichcan be considered a Bernoulli trial.
C→ I When the botnet is under attack, the effort to disconnecteach botnet node can also be considered a Bernoulli trialwith a success probability of p which is the probability ofdisconnection. As botnet mitigation strategies are gener-ally complicated and hard to implement with often limited
impact on the botnet, on average, this per-node successprobability is small.
I→ S & C→ S Similar to the attack on the botnet, each at-tempt to disinfect a node that is in either stages of Infectedor Connected can be considered a Bernoulli trial with asuccess probability of p, i.e., the probability of disinfec-tion. As the identification of most nodes as well as thephysical access to them are hard, on average, this successprobability is small.
With the aforementioned descriptions for the characteristics ofall the inter-stage transitions, the CTMC model can be consid-ered a reasonable approximation.
B. Accordance with Precedence: CTMC as a modeling toolin epidemiology has a proven track record [27] that deals withthe phenomenon of spread of an element within a susceptiblepopulation which has a close resemblance to the spread of mal-ware and the expansion of a botnet. Further, successful useof CTMC models in the study of spread of malware has alsobeen documented [28]. Expansion, and size evolution, of bot-nets happen under the influence of the same physical processesas the ones affecting the spread of malware; therefore, the useof the same CTMC theory for botnets is a natural extension.To our knowledge, the only case of application of CTMC-likemodels to botnets is the work of [9] which is a simulationmodel that has been developed based on the measurement dataof the Storm botnet. Finally, in terms of the choice of Pois-son distribution for the arrival of nodes into a stage (i.e., theexponentially-distributed inter-arrival times), similar to the SICmodel, [12] has also determined this assumption to be reason-able in the study of Conficker-C botnet/worm for the distribu-tion of the number of UDP connection attempts made by aninfected host.
3.2.2. Node Stages and TransitionsA. Main Node Stages Considered: As described in Sub-
section 3.1, the main dynamics of botnets can be captured bykeeping track of the two main node stages, i.e., Infected andConnected. On the other hand, as mentioned in Sub-section2.1, the number of stages considered in a stochastic model, andin our CTMC model in particular, must be limited if we are toavoid an intractable model caused by consideration of severalnode stages. Based on our extensive investigations and consid-ering the prior work done in this field, the optimal tradeoff hasbeen determined to be the consideration of the aforementionedtwo node stages (i.e., Infected and Connected), each being adimension in the CTMC and each having a finite number ofnodes, with Susceptible stage having infinite number of nodes.An infinite susceptible population is a reasonable assumption,since this population corresponds to the population of the entireInternet which is an assumption made also in [9].
B. No Immune/Removed Stage Considered: As botmastersuse a plethora of methods to infect (and re-infect) the nodes,it is reasonable to assume that a node is never in Immune (orRemoved) stage; therefore, we do not consider this stage in ourmodel. It is important to remember that existence and mainte-nance of a botnet is independent of any infection vector (e-mail
5
attachments, file sharing sites, worm scans, etc.) used by thebotmaster and obtaining immunity against one infection vectorstill leaves the node susceptible to be re-infected through otherinfection vectors.
C. Botnet’s Footprint vs. Live Population: Using the ter-minology presented in [29], we emphasize that the SIC modeltracks the botnet’s “footprint” and not its “live population”. Assuch, effects such as day/night differences and time zones whichimpact the number of live botnet nodes at any given time, arenot taken into account. In the SIC model, Connected nodes rep-resent the total number of botnet nodes, i.e., botnet’s footprint.On the other hand, it is possible to use the SIC model and takeinto account the effects of time zones and day/night differenceson λ parameters’ values as follows depending on the length ofthe analysis period: (1) if the analysis period is around or lessthan 24 hours, then, piecewise time-invariant parameters can beused, i.e., we use different sets of values for the λ parameters ineach 12-hour analysis period to account for the day/night dif-ferences and/or the time zones; and (2) if the analysis periodis significantly more than 24 hours, e.g., weekly size variationsare important as is the case in the analysis of FourLakeRidersbotnet in Section 5, then, the variations due to time zones andday/night differences are insignificant and average parametervalues will yield accurate results.
D. Accommodating Time-variant Parameters: As pre-sented, the λ parameters are considered constant throughout theanalysis period. It is however possible to use the SIC modelif these parameters change over time using piecewise time-invariant parameters, i.e., in each piece of the analysis period,we consider the parameters to be constant. The duration of eachpiece can be decided upon on a case-by-case basis; an exam-ple of this kind of analysis, with each piece duration to be aweek, is presented in Section 5. Another example of this kindof analysis, as suggested in the above point, is to accommodatethe effects of time zones and the day/night differences whenthe analysis period is less than 24 hours. In this case, we canchoose a 12-hour analysis period during which we consider theλ parameters to be constant and can set low values for the λparameters during night time.
As described above, the SIC model and its main assumptionsare similar to the model in [9] which has been based on the gath-ered information about the Storm botnet. These assumptionswere further justified mathematically and through comparisonto other similar works. As a result, we believe that we havea realistic model, which leads us to two-dimensional Marko-vian birth-death processes. Using the model, we can study thesize evolution of a botnet as well as effectiveness of mitiga-tion strategies by monitoring the number of nodes that are inInfected and Connected stages at any given time.
4. Performance Modeling of the SIC Model
In this section, we provide an extensive performance model-ing of the SIC model. First, botnet size evolution phases andinitial state values for the SIC model are explained. We thenproceed to derive the probability flow equations based on the
two-dimensional CTMC of the SIC model. These probabil-ity flow equations are further reduced to a partial differentialequation (PDE) of the probability generating function (PGF).Directly from this PDE, we then derive the mean and varianceof the SIC model. Next, the derivation of the Basic Reproduc-tion Number, which is a widely used parameter in epidemiologyand the study of malware propagation, is documented. We con-clude this section by deriving a novel analytical result whichis a link between the SIC model and the mitigation strategiesagainst Distributed Hash Table (DHT)-based P2P botnets.
4.1. Botnet Size Evolution Phases and Initial State ValuesA botnet may go through many phases during its lifecycle,
where a phase will refer to a period that system parameters (λ1,λ2, λr1, λr2, and λa) remain constant. For example, when abotnet appears for the first time, it will probably experience un-hindered expansion as there will not be any active mitigationstrategies to counter its growth, thus λr1, λr2, and λa will bezero. Typically, the botnet’s population will alternate betweensawtooth growth period followed by a period of relatively stablepopulation size [30]. The sawtooth growth begins with the re-lease of a new infection; after sometime, it will be reversed withthe deployment of new counter measures until an equilibrium isreached. Probably, new equilibrium population will have a sizegreater than previous equilibrium size. In any phase, the SICmodel will apply with the end results of the preceding phaseproviding the initial conditions (state values) to the next phase.
4.2. Probability Flow Equations and PDE of PGFIn this section, we determine the probability flow equations
and then, the partial differential equation (PDE) of the probabil-ity generating function (PGF) describing the system. We writeprobability flow equations through inspection from the state-transition-rate diagram given in Fig. 2 by equating the rate ofchange of probabilities at any state to the difference between thetotal input/output flows to/from that state. Let Pn1,n2 (t) denotethe probability that the system is in state (n1, n2) at time t, thenthe probability flow equations are given by:
In order to solve (1) and derive the probability distributionPn1,n2 (t), a known method is to transform the equations of prob-ability flows to a partial differential equation (PDE) of the prob-ability generating function (PGF) which can be tackled usingknown methods to solve PDEs. The relationship between thePGF P(z1, z2, t) and the probability distribution Pn1,n2 (t) is asfollows: P(z1, z2, t) =
∑∞n1=0
∑∞n2=0 Pn1,n2 (t)zn1
1 zn22 .
The initial probability distribution is denoted by Pk1,k2 (0).Here, we assume that the initial number of nodes in each stageis constant (k1, k2). Though the initial derivations are condi-tional, we will suppress the conditions for simplicity in express-ing the PDE. This aspect, however, has been fully taken care ofin the derivation of means (e.g., see (C.5) and (C.6)) and laterin the derivation of variances.
We multiply each of the equations in (1) by zn11 zn2
2 , sum overthe respective ranges of n1 and n2, and then add them together.After some simplifications and manipulations (detailed deriva-tion provided in Appendix A), we arrive at the following PDEof the PGF:
Our efforts to solve the preceding PDE, however, have notbeen successful, as detailed in Appendix B. Nonetheless, thereare publications reporting new solved cases of Abel/Lienardequations (differential equations encountered in the process ofsolving the PDE). Thus, it is possible that we may have the so-lution of the PDE in the near future. We can still obtain fromthe PDE the moments of botnet population size, as presentednext.
4.3. Derivation of the Time-dependent Mean and Variance ofBotnet Population Size
In this section, we derive the means and variances of thenumber of nodes in Infected stage and Connected stage (bot-net population size) as a function of time. Let Et[n1] and Et[n2]denote the mean number of nodes that are in Infected and Con-nected stages at time t, respectively, then:
Et[n1] =∂P(z1, z2, t)
∂z1|z1=z2=1 , Et[n2] =
∂P(z1, z2, t)∂z2
|z1=z2=1
(3)We take the derivatives of the PDE given in (2) with respect toz1 and z2, separately. By setting z1 = z2 = 1 in each resultingequation, we arrive at a set of ODEs of Et[n1] and Et[n2]. Toemphasize the time dependency of the means from here on, wewill denote Et[n1] and Et[n2] by E1(t) and E2(t), respectively.Note that only the important steps of derivation are providedhere; the rest of the steps is in Appendix C. After the initialsteps outlined above and detailed in the appendix, we arrive atthe following set of ODEs: dE1(t)
dt = (λ1 + λa)E2(t) − (λ2 + λr1)E1(t)dE2(t)
dt = λ2E1(t) − (λr2 + λa)E2(t)(4)
We then proceed to derive E1(t) and E2(t) from the previousset of ODEs as detailed in Appendix C; the final results are asfollows:
Next, we describe the derivation of variances, which aregiven by:
σ21(t) = Et[n2
1] − (E1(t))2 , σ22(t) = Et[n2
2] − (E2(t))2 (7)
where:
Et[n21] =
∂2P(z1, z2, t)∂z2
1
|z1=z2=1 +∂P(z1, z2, t)
∂z1|z1=z2=1
Et[n22] =
∂2P(z1, z2, t)∂z2
2
|z1=z2=1 +∂P(z1, z2, t)
∂z2|z1=z2=1 (8)
Let us define:
ψ1(t) ,∂2P(z1, z2, t)
∂z21
|z1=z2=1
ψ2(t) ,∂2P(z1, z2, t)
∂z22
|z1=z2=1
ψ12(t) ,∂2P(z1, z2, t)∂z1∂z2
|z1=z2=1 (9)
Considering that E1(t = 0) = k̄1 and E2(t = 0) = k̄2, the preced-ing functions have the following initial values:
ψ1(t = 0) = k̄21 − k̄1 , ψ2(t = 0) = k̄2
2 − k̄2 , ψ12(t = 0) = ¯k1k2(10)
The variances are then given by:
σ21(t) = ψ1(t)+ E1(t)− (E1(t))2 , σ2
2(t) = ψ2(t)+ E2(t)− (E2(t))2
(11)Next, we take the 2nd derivatives of the PDE in (2) with re-spect to z1 and z2, separately. Further, we take the derivativeof the PDE with respect to z1 and then with respect to z2 (see
7
Appendix D). By setting z1 = z2 = 1 in each resulting equa-tion, we arrive at a set of ordinary differential equations, whichif written in terms of ψ1(t), ψ2(t), and ψ12(t) is, as follows:
Finally, from the preceding set of ODEs, we obtain the vari-ances, as explained in Appendix D.
4.4. Epidemiological Threshold: Basic Reproduction Number
Basic Reproduction Number1 (R0) is a widely used parame-ter in epidemiology as well as in the study of malware propaga-tion. In the context of botnets, this number is the mean numberof infections that any single botnet node can cause among thepopulation of susceptible nodes. The measurement of the meannumber is assumed to happen with the presence of mitigationstrategies that bring down the number of botnet nodes while theremaining botnet nodes cause new infections. R0 is calculatedbased on the rates used in the model. If R0 < 1, the botnetwill eventually disappear with probability one. If R0 > 1, how-ever, there is a probability that the botnet size will continue toincrease exponentially.
Based on (4), the Basic Reproduction Number (R0) can bederived in terms of various SIC model’s parameters using the“Next Generation Matrix” method as follows (detailed deriva-tion in Appendix E):
R0 =
√λ2(λ1 + λa)
(λr2 + λa)(λ2 + λr1)(13)
4.5. P2P Botnet Mitigation Strategies and the SIC Model
As our last analytical result, we present a link between life-cycle (or propagation/population) models and the P2P botnetmitigation strategies. Mitigation strategies aimed at DistributedHash Table (DHT)-based P2P botnets include sybil, index poi-soning, and eclipse attacks. We base the discussion on randomsybil attack, however, the process is similar for other attacktypes.
Sybil attack, first presented in [31], is an attack method underwhich numerous clean nodes (sybils) are injected into the P2Pbotnet, posing themselves as “legitimate” botnet nodes. Theythen try to re-route, block, and corrupt the Command & Con-trol (C&C) traffic, thereby lowering the efficiency of the C&Cmechanism of the botnet. In a DHT-based P2P botnet, nodesfind each other, construct their routing tables, and relay the
1In the theoretical epidemiology literature [27], Basic Reproduction Num-ber (R0) generally refers to the onset of disease spread. Once the epidemic isunderway, and especially when control measures (mitigation strategies) are putinto effect, other terminologies such as “Control Reproduction Number (Rc)”and “Effective Reproduction Number (Re)” are used instead to refer to essen-tially the same threshold parameter. In this paper, we use the phrase “BasicReproduction Number (R0)” in all instances.
traffic to, or closer to, its intended destination based on normalDHT methods. The botmaster also relies on the aforementionedmethods for the C&C of the botnet; therefore, the decreased ef-ficiency of the C&C mechanism as a result of the sybil attacktranslates into an inefficient botnet.
Random sybil attack on P2P botnets has been studied in [21].The derived formula therein can be used to construct a relation-ship between the number of sybils inserted in the network andλan2, the transition rate from Connected stage to Infected stage(cf. Fig. 1). The obtained formula for the random sybil attackis the following [21]:
Ps(ns) =
(1 −
ns
ns + n
) log2(ns+n)b
(14)
Where:
Ps(ns) The probability that a botnet node successfully obtainsthe commands of the botmaster.
ns The number of sybils inserted randomly in the network.
b The number of bits improved per step for a lookup (set to amid-range value of 5 in our study [21]).
n The botnet size. This is the value of n2 in our model.
We therefore note that 1 − Ps(ns) is the probability that abotnet node is no longer able to receive the commands of thebotmaster as a result of the attack on the botnet (insertion ofsybils). This probability is therefore equal to λa∆t, as the lat-ter is the approximate probability that a botnet node transitionsfrom Connected stage to Infected stage (i.e., the node gets dis-connected).
0 2 4 6 8 10 120
1000
2000
3000
4000
5000
6000
Time HhoursL
Me
an
Nu
mb
er
of
Co
nn
ecte
dN
od
es
0 2 4 6 8 10 120
10000
20000
30000
40000
50000
Time HhoursL
Me
an
Nu
mb
er
of
Infe
cte
dN
od
es
Figure 3: GreenAlienRiders (a Zeus-based botnet): initial un-hindered botnet expansion estimated using the SIC model.
8
+ ++
+
+
+
0 200 400 600 8000
200000
400000
600000
800000
1.0´106
1.2´106
Time HhoursL @duration: 5 weeksD
Num
ber
of
Connecte
dN
odes
(a) Reported weekly botnet size evolution
0 200 400 600 8000
200000
400000
600000
800000
1.0´106
1.2´106
Time HhoursL @duration: 5 weeksD
Me
an
Nu
mb
er
of
Co
nn
ecte
dN
od
es
0 200 400 600 8000
200000
400000
600000
800000
1.0´106
1.2´106
Time HhoursL @duration: 5 weeksD
Me
an
Nu
mb
er
of
Co
nn
ecte
dN
od
es
0 200 400 600 8000
200000
400000
600000
800000
1.0´106
1.2´106
Time HhoursL @duration: 5 weeksD
Me
an
Nu
mb
er
of
Co
nn
ecte
dN
od
es
0 200 400 600 8000
200000
400000
600000
800000
1.0´106
1.2´106
Time HhoursL @duration: 5 weeksD
Me
an
Nu
mb
er
of
Co
nn
ecte
dN
od
es
Weeks 39-40
Week 38
Week 37
Week 36
(b) Botnet size evolution reconstructed using the SIC Model
Figure 4: FourLakeRiders (a Zeus-based botnet): botnet mitigation strategies analyzed using the SIC model. To produce Figs. 4band 5, parameter values have been chosen as follows: During the whole 5-week period, λ1 and λ2 are constant and set as follows:λ1 = 0.042 and λ2 = 0.001. λr1 , λr2 , and λa are chosen as follows for each week: Part 1 (Week 36): λr1 = 0.0082 , λr2 = 0.0046, and λa = 0; Part 2 (Week 37): λr1 = 0.0082 , λr2 = 0.0027 , and λa = 0; Part 3 (Week 38): λr1 = 0 , λr2 = 0 , and λa = 0; Part 4(Weeks 39-40): λr1 = 0.0082 , λr2 = 0.0046 , and λa = 0.0057. All λ parameters are nodes/hour.
0 200 400 600 8000
1´106
2´106
3´106
4´106
5´106
6´106
Time HhoursL
Mean
Num
ber
of
Infe
cte
dN
odes
0 200 400 600 8000
1´106
2´106
3´106
4´106
5´106
6´106
Time HhoursL
Mean
Num
ber
of
Infe
cte
dN
odes
0 200 400 600 8000
1´106
2´106
3´106
4´106
5´106
6´106
Time HhoursL
Mean
Num
ber
of
Infe
cte
dN
odes
0 200 400 600 8000
1´106
2´106
3´106
4´106
5´106
6´106
Time HhoursL
Mean
Num
ber
of
Infe
cte
dN
odes Weeks 39-40
Week 38
Week 37
Week 36
Figure 5: FourLakeRiders botnet: size evolution of the numberof Infected nodes estimated using the SIC Model. Parametervalues are mentioned in the caption of Fig. 4
The aforementioned link between lifecycle models and theP2P botnet mitigation strategies is therefore demonstrated usingthe following formula:
λa∆t = 1 − Ps(ns) (15)
As seen in (14), Ps(ns) is a function of ns. At any instant oftime, a change in λa (i.e., ∆λa) is a result of a change in thenumber of sybils (i.e., ∆ns). Based on (15), we can then ana-lyze the relationship between the amount of change of λa withrespect to a change in the number of sybils inserted in the net-work as follows:
λa + ∆λa
λa=
1 − Ps(ns + ∆ns)1 − Ps(ns)
(16)
5. SIC Model vs. Reported Botnet Measurements
In this section, we show that our results can be used to modelthe botnets in the real-world. Measurements of the size of somebotnets have been reported on a weekly basis by Damballa [30].
Assuming that the employed measurement techniques capturecorrectly the global size of the botnets, in this section, we exam-ine how such measurement results would compare to the resultspredicted by the SIC model. First, we examine a case of initialunhindered botnet expansion, based on available data from aZeus-based botnet called GreenAlienRiders. Next, we will ex-amine a case of deployment of mitigation strategies, based onavailable data from another Zeus-based botnet called FourLak-eRiders.
GreenAlienRiders is a botnet for which the initial unhinderedexpansion phase has been captured and reported by Damballa[30]. From the Damballa report, it appears that the botnet hasreached the size of about 6,000 nodes at Hour 12 of its ap-pearance. To reach this size, using the SIC model, we can setλ1 = 6.85 and λ2 = 0.1 (both nodes/hour). The result is shownin Fig. 3. Further, Fig. 3 also shows the SIC model’s estimateof the existing Infected nodes during this period.
FourLakeRiders, on the other hand, is a botnet for which de-ployment of mitigation strategies can be analyzed based on aportion of data of the botnet size evolution over time, a 5-weekperiod from Week 36 to Week 40, as captured and reported byDamballa [30]. The data reported for this 5-week period lendsitself to an analysis with clear separation of effects of each ofthe mitigation strategies. The scenario that follows, however,represents one of potentially many possibilities. The reporteddata on botnet size during this 5-week period is depicted in Fig.4a. A scenario that fits this pattern of rise-and-fall is as follows:during Week 36, the botnet size has reached an equilibrium; onone side, the number of Infected and Connected nodes grow,and on the other side, some mitigation strategies are reducingthe number of Infected and Connected nodes (λr1, λr2). DuringWeek 37, the aforementioned mitigation strategies weaken and,during Week 38, they completely disappear, which results in asteep growth of the size of the botnet. During Weeks 39 and 40,all mitigation strategies are employed (λr1, λr2, and λa), whichresults in a dramatic reduction in the size of the botnet. Thedescribed scenario, and the chosen parameter values to make ithappen, are depicted and mentioned in Fig 4b. The potential
9
number of Infected nodes are estimated using the SIC model aswell, as depicted in Fig. 5. As may be seen, during both expan-sion and shrinkage, our results follow quite well the reporteddata.
6. Numerical Analysis
In this section, we present some numerical results to furtherillustrate the usefulness of the SIC model. First, we briefly in-troduce some parameter estimation techniques which help withthe use of the SIC model. The first set of numerical results arewith regard to the analysis of the initial unhindered expansionof a botnet. We then show how the SIC model could help withthe evaluation and comparison of mitigation strategies. Botnetsize standard deviation and utilization of Basic ReproductionNumber are then depicted and examined next. We conclude thissection by examining the developed analytical link between theSIC model and the P2P botnet mitigation strategies through ananalysis of a random sybil attack on a P2P botnet. Throughoutthis section, we plot the previously-derived analytical results byassigning values to various parameters (λ1, λ2, λr1, λr2, and λa),all with the unit of nodes/time unit (time unit can be hour, day,week, or any other period). The plotted results are thereforegeneral as parameter values may be assumed to be nodes perany time unit and then the plotted time-dependent performancemeasures will be interpreted as functions of that time unit.
6.1. Model’s Parameter Estimation Techniques
Using the SIC model, the botnet size estimation problem hasreduced from having to estimate the global size of the botnetto the estimation of the model’s parameters (λ1 and λ2) whichrequires only local knowledge. On the other hand, values forλr1, λr2, and λa depend on the type of disinfection and attack onthe botnet; as the mitigation strategies are being conducted bythe security experts, they will be able to reliably choose valuesfor these latter parameters.
As a starting point, we would suggest a consideration of thefollowing methods when trying to estimate values for λ1 and λ2:(1) real botnet size measurements, if available, can be used toestimate the parameter values (as done in Section 5); (2) localmeasurements through Honeynet log analysis [32], for exam-ple; and (3) a statistical approach to botnet virulence estimation(vulnerability and infection rates estimation) [33].
6.2. Initial Unhindered Botnet Expansion
We first examine the unhindered botnet expansion that hap-pens when the botnet first appears. In Fig. 6, we consider a12-time-unit period during which the botnet expands. In thisinitial phase, there is neither any attack on the botnet, nor anyremoval (disinfection) from Infected/Connected stages; hencewe set λr1 = λr2 = λa = 0. We choose λ1 = 7 and λ2 = 0.1 asthe center values for these parameters; these values are based onthe values derived from the analysis of GreenAlienRiders bot-net (cf. Fig. 3). We then examine how the mean values of thenumber of nodes in Infected stage and Connected stage (botnet
size) would change over this initial expansion period by vary-ing the parameter values in the following ranges: 0 ≤ λ1 ≤ 11and 0 ≤ λ2 ≤ 0.2. In Figs. 6a and 6b, we set λ2 = 0.1 and ex-amine the change of mean values over time by varying λ1 over[0, 11]. In Figs. 6c and 6d, on the other hand, we set λ1 = 7and examine the change of mean values over time by varyingλ2 over [0, 0.2]. Slicing Figs. 6b and 6d at t = 12, Figs. 6eand 6f closely show how mean numbers would change over therespective ranges of values for λ1 and λ2. Finally, Fig. 7 showsthe means along with the standard deviations.
6.3. Comparison of Mitigation Strategies
One of the main advantages of the SIC model is that it en-ables the security experts to compare and analyze mitigationstrategies before deployment. In this sub-section, we study thecase where botnet faces attack and/or removal (disinfection)and observe how severe these interventions must be in orderto contain or dismantle the botnet. In all scenarios, we assignλ1 = 7 and λ2 = 0.1; their choice has no bearing on the follow-ing analysis regarding λr1, λr2, and λa. Further, we assume themean number of Infected nodes and Connected nodes to be asfollows: E1(0) = k̄1 = 53484 and E2(0) = k̄2 = 6786; thesevalues are derived from Fig. 7 at t = 12 when λ1 = 7 andλ2 = 0.1. We can then proceed to analyze how this particularbotnet would react to different mitigation strategies.
In Fig. 8, the solid line depicts the scenario where there areno mitigation strategies and the number of Infected nodes andthe botnet size continue to increase. Dotted/dashed lines denotescenarios under which different values chosen for λr1, λr2, andλa result in different trajectories for the mean. In Fig. 8a, weobserve that the mean eventually goes to zero in only one sce-nario, i.e., when all three strategies are employed at the sametime. Note that a large enough value chosen for λr1 would makethe mean number of nodes in Infected stage go to zero as well.Fig. 8b depicts the same scenarios as in Fig. 8a, but this time,the mean is for the nodes in Connected stage (botnet size). Inthis particular case, we observe that the mean number of nodesin Connected stage also eventually goes to zero in only one sce-nario, i.e., when all three strategies are employed at the sametime.
We can therefore state that, all things being equal, re-moval/disinfection from Connected stage (λr2) has the most ef-fect on containing the size of the botnet (nodes in Connectedstage). Further, we intuitively deduce that it would be lesscostly to combat a botnet if we implement all three strategiesat the same time, as we can choose moderate disinfection/attackrates. Concentrating on a single strategy (disinfection or attack)would mean that we need to choose a very high rate to achievea comparable effect. Having to choose a high rate is usually as-sociated with high cost in the real world (e.g., the plan of mal-ware removal from near 100% of computers is either infeasibleor extremely costly to implement).
6.4. Standard Deviation and Basic Reproduction Number
In Fig. 9, we draw the mean along with the standard devi-ation in each sub-figure. Inclusion of standard deviation helps
10
0
5
10
t
0
5
10
Λ1
0
200000
400000
600000
800000
(a) Eu1(t), λ2 = 0.10
5
10
t
0
5
10
Λ1
0
20000
40000
60000
80000
(b) Eu2(t), λ2 = 0.1
0
5
10
t
0.00
0.05
0.10
0.15
0.20
Λ2
0
200000
400000
600000
800000
(c) Eu1(t), λ1 = 7
0
5
10
t
0.00
0.05
0.10
0.15
0.20
Λ2
0
20000
40000
60000
80000
(d) Eu2(t), λ1 = 7
0 2 4 6 8 10 110
20000
40000
60000
80000
Λ1 Hnodes�time unitL
Mean
Num
ber
of
Connecte
dN
odes
(e) Eu2(t = 12), λ2 = 0.1
0 0.05 0.1 0.15 0.20
20000
40000
60000
80000
Λ2 Hnodes�time unitL
Me
an
Nu
mb
er
of
Co
nn
ecte
dN
od
es
(f) Eu2(t = 12), λ1 = 7
Figure 6: Initial unhindered botnet expansion. Mean number of nodes in Infected stage (Eu1(t)) and Connected stage (Eu2(t)).Initial state values: Eu1(0) = k̄1 = 0, Eu2(0) = k̄2 = 1. The subscript u refers to the Unhindered expansion.
0 2 4 6 8 10 120.1
1
10
100
1000
104
105
Time
Nu
mb
er
of
Infe
cte
dN
od
es
Σu1HtL
Eu1HtL
0 2 4 6 8 10 120.1
1
10
100
1000
104
105
Time
Nu
mb
er
of
Co
nn
ecte
dN
od
es
Σu2HtL
Eu2HtL
Figure 7: Initial unhindered botnet expansion. Mean and standard deviation of the number of nodes in Infected and Connectedstages. Initial state values: Eu1(0) = k̄1 = 0, Eu2(0) = k̄2 = 1. Parameter values: λ1 = 7, λ2 = 0.1 (both nodes/time unit)
11
0 2 4 6 8 10 120
20000
40000
60000
80000
100000
Time
Me
an
Nu
mb
er
of
Infe
cte
dN
od
es
Scenario 5
Scenario 4
Scenario 3
Scenario 2
Scenario 1
(a) E1(t)
0 2 4 6 8 10 120
20000
40000
60000
80000
100000
Time
Me
an
Nu
mb
er
of
Co
nn
ecte
dN
od
es
Scenario 5
Scenario 4
Scenario 3
Scenario 2
Scenario 1
(b) E2(t)
Figure 8: Comparison of mitigation strategies. Mean number of nodes in Infected stage (E1(t)) and Connected stage (E2(t)). Initialstate values: E1(0) = k̄1 = 53484, E2(0) = k̄2 = 6786; Parameter values: λ1 = 7, λ2 = 0.1; Scenario 1: unhindered expansion(λr1 = 0, λr2 = 0, λa = 0); Scenario 2: only removal of Infected nodes (λr1 = 2, λr2 = 0, λa = 0); Scenario 3: only removal ofConnected nodes (λr1 = 0, λr2 = 2, λa = 0); Scenario 4: only attack on botnet (λr1 = 0, λr2 = 0, λa = 2); Scenario 5: three strategiessimultaneously (λr1 = 2, λr2 = 2, λa = 2). All λ parameters are nodes/time unit.
0 2 4 6 8 10 12100
500
1000
5000
1´104
5´104
1´105
Time
Nu
mb
er
of
Infe
cte
dN
od
es
(a) R0 = 0.8
0 2 4 6 8 10 12100
500
1000
5000
1´104
5´104
1´105
Time
Nu
mb
er
of
Infe
cte
dN
od
es
(b) R0 = 1.0
0 2 4 6 8 10 12100
500
1000
5000
1´104
5´104
1´105
Time
Nu
mb
er
of
Infe
cte
dN
od
es
Σ1HtL
E1HtL
(c) R0 = 1.2
0 2 4 6 8 10 12100
500
1000
5000
1´104
5´104
1´105
Time
Nu
mb
er
of
Co
nn
ecte
dN
od
es
(d) R0 = 0.8
0 2 4 6 8 10 12100
500
1000
5000
1´104
5´104
1´105
Time
Nu
mb
er
of
Co
nn
ecte
dN
od
es
(e) R0 = 1.0
0 2 4 6 8 10 12100
500
1000
5000
1´104
5´104
1´105
Time
Nu
mb
er
of
Co
nn
ecte
dN
od
es
Σ2HtL
E2HtL
(f) R0 = 1.2
Figure 9: Number of nodes in Infected stage (upper row figs.) and Connected stage (lower row figs.). Parameter values are asfollows: k̄1 = 53484 , k̄2 = 6786 , λ1 = 7 , λ2 = 0.1 , and λa = 0.2 for all sub-figures; for left sub-figures: R0 = 0.8, λr1 = 1, andλr2(determined) = 0.8227 ; for center sub-figures: R0 = 1, λr1 = 0.8135, and λr2(determined) = 0.5880 ; and for right sub-figures:R0 = 1.2, λr1 = 1, and λr2(determined) = 0.2545. All λ parameters are nodes/time unit.
12
0 200 400 600 800 10000
50
100
150
200
250
300
Percentage increase in the number of Sybil nodes
Perc
enta
ge
incre
ase
inth
evalu
eofΛ
a
Figure 10: Relationship between the attack rate (λa) and thenumber of sybils (Initial ns = 1000, n = k̄2 = 6786, and b = 5)
put the mean in its proper context; the higher the standard de-viation gets, the less should be the importance of the precisevalue of the mean in our interpretations. Since we consider thatall mitigation strategies are being implemented, the sub-figuresof Fig. 9 would be comparable to Fig. 8, as the chosen initialstate values (values for k̄1 and k̄2) are the same.
Furthermore, in Fig. 9, we use the derived formula for BasicReproduction Number (R0) to choose values for different pa-rameters in a way that leads to the size of the botnet shrinking(left sub-figs.), remaining constant (center sub-figs.) or grow-ing (right sub-figs.). To achieve this, we choose sample valuesfor various parameters (except for λr2) and for R0; therefore, thevalue of λr2 would be determined in order to satisfy (13).
6.5. Random Sybil Attack on DHT-based P2P Botnets
Finally, we provide a numerical analysis of the developedrelationship between the SIC model’s attack rate (λa) and thenumber of sybils inserted in the P2P botnet. The analysis willbe the case of adding the sybils at t = 0 in Fig. 8, assuming aninstantaneous effect on the P2P botnet, and examining the situ-ation in the next ∆t. The numerical result is derived from (16)and depicted in Fig. 102. The figure demonstrates the relation-ship between the percentage increase in the number of insertedsybils and the resulting percentage increase in the value of λa.The demonstrated relationship leads to the following insight:once the sybil attack is underway, the value of ns is known andthe resulting λa can be measured. The security expert can thendetermine, for example, how many sybils should be added inorder to arrive at a desired λa to have the intended mitigationeffect.
7. Concluding Remarks and Future Work
There is a lack of appropriate analytical models on botnetsin the literature. The prior work on botnets mostly consists ofeither deterministic analytical or simulation-based models. The
2As the size of botnet changes with time, it is necessary to update the re-spective calculated values in regular intervals to keep a close approximation.
deterministic models have the drawback of treating the botnetsize as a deterministic variable, which neglects the stochasticnature of the evolution of botnets. These models only lead todetermination of the mean botnet population size and not to theprobability distribution of size or its higher moments. Further,the existing models determine the mean botnet size numericallyand they have not obtained closed form expressions. On theother hand, simulation-based models can be designed to cap-ture the details of botnet lifecycle, but their results cannot beeasily replicated or used by others. Finally, we have shown thatour results may be used to model the size evolution of botnets,including their sudden growth, in the real-world.
In this paper, we have developed a stochastic analyticalmodel that captures the dynamics of a botnet’s lifecycle. Wehave modeled the lifecycle of a node in the system with threestages referred to as, Susceptible, Infected, and Connected. Fur-ther, we have assumed that the nodes in the Infected and Con-nected stages may go back to Susceptible stage. We have mod-eled the system using a two-dimensional Markov process andderived a partial differential equation for the joint distribution ofthe number of nodes in each stage. Though this equation couldnot be solved, we were able to obtain closed form expressionsfor the time dependent mean and variance of the population sizein each stage. It is possible to obtain even higher moments ofthe botnet population size, but the results get too complicated.
To our knowledge, the demonstrated relationship between alifecycle/population model and the P2P botnet mitigation strate-gies is the first of its kind presented in the open literature. Thedeveloped relationship leads to a two-step, or recursive, anal-ysis process: (1) examining the effect of the chosen λa on thebotnet size based on Eq. 4 for the means; and (2) examining therelationship between a change of λa and the associated changein the number of sybils based on Eq. 16. We are currently work-ing on the integration of these two steps which entails changesto the SIC model itself and leads to an analytical model specificto DHT-based P2P botnets.
Appendix A. Deriving a PDE from the Differential-Difference Equations
Replacing (A.4) through (A.9) with the ones derived in (A.10)through (A.15), after simplification, we arrive at (2).
Appendix B. Attempt to Solve the PDE Using Method ofCharacteristics
We describe our efforts to solve the partial differential equa-tion (2) describing the system. Following the Method of Char-acteristics [34, p.432] to solve PDEs, based on (2), we canwrite:
Equations (B.1.c) and (B.1.d) are “non-separable”, i.e., we can-not derive z1 and z2 from 1st order ordinary differential equa-tions (ODEs). We therefore proceed as follows: from (B.1.c),we derive z2:
z2 =1λ2
[dz1
ds+ (λr1 + λ2)z1 − λr1] (B.5)
Replacing z2 in (B.1.d) with the expression given in (B.5), aftersome simplifications, we can write (B.1.d) as follows:
d2z1
ds2 + (λr1 + λ2 + λ1 + λr2 + λa)dz1
ds
−λ1z1dz1
ds− λ1(λr1 + λ2)z2
1
+ ((λ1 + λr2 + λa)(λr1 + λ2) + λ1λr1 − λaλ2) z1
−(λ1 + λr2 + λa)λr1 − λr2λ2 = 0 (B.6)
14
Equation (B.6) has the form of a second order Lienard equation[35] given below:
d2z1
ds2 + (A + Bz1)dz1
ds+ Cz2
1 + Dz1 + E = 0 (B.7)
Equation (B.7) is not in the form of solvable cases presentedin [35, Sec.2.2.3-2], [36, pp.204-5], and [37]. As a further at-tempt to solve (B.7), we have used the following substitutionsuggested in [35, Sec.2.2.3-1]:
w =dz1
ds,
d2z1
ds2 = w′s = w′z1
dz1
ds= w′z1
w (B.8)
The above substitution transformed (B.7) into an Abel equationof the 2nd kind given below:
ww′z1+ (A + Bz1)w + Cz2
1 + Dz1 + E = 0 (B.9)
Equation (B.9) is also not among the solvable cases presentedin [35, Sec.1.3.3-2].
Appendix C. Derivation of Means from the PDE of thePGF
We take the derivative of (2) with respect to z1 as follows:
where k1 and k2 are values of n1 and n2 at t = 0, respectively.Note that k1 and k2 are variables themselves and their means areobtained as follows:k̄1 =
∑∞k1=0
∑∞k2=0k1Pk1,k2 (t = 0)
k̄2 =∑∞
k1=0∑∞
k2=0k2Pk1,k2 (t = 0)(C.6)
k̄1 and k̄2 are therefore the values of the means at t =
0. We then proceed to uncondition (C.5), i.e., we take∑∞k1=0
∑∞k2=0 {X} Pk1,k2 (t = 0), with X being each element of the
The solution of (D.5) (i.e., the expressions for ψ1(s) andψ2(s)) as well as the expressions for σ2
1(t) and σ22(t) are ex-
tremely lengthy; hence, they are provided in [38] instead due tospace constraints.
Appendix E. Basic Reproduction Number Calculationthrough the “Next Generation Matrix”Method
Based on the steps of the “Next Generation Matrix” method[27, pp.160-5], we proceed as follows: From SIC model’s dif-ferential equations for means (i.e., (4)), we extract the f and vmatrices:
f =
(λ1+λa)E2(t)
λ2E1(t)
v=
(λ2+λr1)E1(t)
(λr2+λa)E2(t)
(E.1)
F and V matrices would be therefore as follows:
F=
0 λ1+λa
λ2 0
V=
λ2+λr1 00 λr2+λa
(E.2)
The next generation matrix (K) would be as follows:
K = F×V−1
=
0 λ1+λa
λ2 0
× 1(λ2+λr1)(λr2+λa )
λr2+λa 00 λ2+λr1
= 1
(λ2+λr1)(λr2+λa )
0 (λ1+λa)(λ2+λr1)
λ2(λr2+λa) 0
K =
0 λ1+λaλr2+λa
λ2λ2+λr1
0
(E.3)
To derive R0, we proceed as follows:
det(K−R0×I)=0 (E.4)
where I is an identity matrix. We therefore have:
det
−R0λ1+λaλr2+λa
λ2λ2+λr1
−R0
= 0
R20−
λ1+λaλr2+λa
×λ2
λ2+λr1= 0
Basic Reproduction Number (R0) is therefore derived as notedin (13).
References
[1] S. Mansfield-Devine, Battle of the botnets, Network Sec. (2010) 4 – 6.[2] D. Bleaken, Botwars: the fight against criminal cyber networks, Com-
puter Fraud & Security 2010 (2010) 17 – 19.[3] C. J. Mielke, H. Chen, Botnets, and the cybercriminal underground, in:
Proc. IEEE Int. Conf. Intel. & Sec. Informatics ISI 2008, pp. 206–211.[4] W. H. Murray, The application of epidemiology to computer viruses,
Computers & Security 7 (1988) 139 – 145.[5] J. O. Kephart, S. R. White, Directed-graph epidemiological models of
computer viruses, in: Proc. IEEE Computer Society Symp Research inSecurity and Privacy, IEEE Comput. Soc. Press, 1991, pp. 343–359.
[6] G. Serazzi, S. Zanero, Computer virus propagation models, in: M. C.Calzarossa, E. Gelenbe (Eds.), Performance Tools and Applications toNetworked Systems, volume 2965 of Lecture Notes in Computer Science,Springer Berlin Heidelberg, 2004, pp. 26–50.
[7] S. Fei, L. Zhaowen, M. Yan, A survey of internet worm propagationmodels, in: Proc. 2nd IEEE Int. Conf. Broadband Network & MultimediaTechnology IC-BNMT ’09, IEEE, 2009, pp. 453–457.
[8] M. Ajelli, R. L. Cigno, A. Montresor, Modeling botnets and epidemicmalware, in: Proc. IEEE Int’l Comm. Conf. (ICC), IEEE, 2010, pp. 1–5.
[9] E. V. Ruitenbeek, W. H. Sanders, Modeling peer-to-peer botnets, in:QEST ’08: Proc. of the 2008 Fifth Int’l Conference on Quantitative Eval-uation of Systems, IEEE Comp. Soc., 2008, pp. 307–316.
[10] X. Li, H. Duan, W. Liu, J. Wu, The growing model of botnets, in: Proc.Int Green Circuits and Systems (ICGCS) Conf, IEEE, 2010, pp. 414–419.
[11] Q. Wang, Z. Chen, C. Chen, N. Pissinou, On the robustness of the botnettopology formed by worm infection, in: Proc. IEEE Global Telecommu-nications Conf. GLOBECOM 2010, pp. 1–6.
[12] R. Weaver, A probabilistic population study of the conficker-c botnet,in: Passive and Active Measurement, volume 6032 of Lecture Notes inComputer Science, Springer Berlin / Heidelberg, 2010, pp. 181–190.
[13] S. B. Banks, M. R. Stytz, Advancing botnet modeling techniques formilitary and security simulations, in: Proc SPIE Int Soc Opt Eng, volume8060, SPIE - The International Society for Optical Engineering, Orlando,FL, United states, 2011.
[14] Y. Wang, S. Wen, W. Zhou, W. Zhou, Y. Xiang, The probability model ofpeer-to-peer botnet propagation, in: Y. Xiang, A. Cuzzocrea, M. Hobbs,W. Zhou (Eds.), Algorithms and Architectures for Parallel Processing,volume 7016 of Lecture Notes in Computer Science, Springer Berlin /
Heidelberg, 2011, pp. 470–480.[15] C. C. Zou, R. Cunningham, Honeypot-aware advanced botnet construc-
tion and maintenance, in: Proc. Int. Conf. Dependable Systems and Net-works DSN 2006, pp. 199–208.
16
[16] D. Dagon, C. Zou, W. Lee, Modeling botnet propagation using timezones, in: Proceedings of the 13th Network and Distributed System Se-curity Symposium, NDSS, Internet Society, 2006.
[17] R. Li, L. Gan, Y. Jia, Propagation model for botnet based on confickermonitoring, in: Proc. Second Int Information Science and Engineering(ISISE) Symp, IEEE, 2009, pp. 185–190.
[18] W. Xin-liang, C. Lu-Ying, L. Fang, L. Zhen-ming, Analysis and model-ing of the botnet propagation characteristics, in: Proc. 6th Int WirelessComm. Netw. & Mobile Comp. (WiCOM) Conf, IEEE, 2010, pp. 1–4.
[19] P. Porras, H. Saidi, V. Yegneswaran, A Multi-perspective Analysis ofthe Storm (Peacomm) Worm, CSL Technical Note, Computer ScienceLaboratory, SRI International, 2007. [Online]. Available: http://www.cyber-ta.org/pubs/StormWorm/.
[20] M. Bailey, E. Cooke, F. Jahanian, Y. Xu, M. Karir, A survey of bot-net technology and defenses, in: CATCH ’09: Proceedings of the 2009Cybersecurity Applications & Technology Conference for Homeland Se-curity, IEEE Comp. Soc., 2009, pp. 299–304.
[21] P. Wang, L. Wu, B. Aslam, C. Zou, A systematic study on peer-to-peerbotnets, in: Proc. of 18th Int’l Conf. on Computer Communications andNetworks, 2009. ICCCN 2009, pp. 1 –8.
[22] J. B. Grizzard, V. Sharma, C. Nunnery, B. B. Kang, D. Dagon, Peer-to-peer botnets: overview and case study, in: HotBots’07: 1st Workshop onHot Topics in Understanding Botnets, USENIX Ass., 2007.
[23] Q. Wang, Z. Chen, C. Chen, Characterizing internet worm infection struc-ture, in: Proceedings of the 4th USENIX conference on Large-scale ex-ploits and emergent threats, LEET’11, USENIX Association, Berkeley,CA, USA, 2011.
[24] Z. Li, A. Goyal, Y. Chen, V. Paxson, Automating analysis of large-scalebotnet probing events, in: Proceedings of the 4th International Sym-posium on Information, Computer, and Communications Security, ASI-ACCS ’09, ACM, New York, NY, USA, 2009, pp. 11–22.
[25] C. C. Zou, D. Towsley, W. Gong, On the performance of internet wormscanning strategies, Perform. Eval. 63 (2006) 700–723.
[26] A. Papoulis, S. U. Pillai, Probability, Random Variables and StochasticProcesses, McGraw-Hill, 4th edition, 2002.
[27] F. Brauer, P. van den Driessche, J. Wu (Eds.), Mathematical Epidemiol-ogy, Springer-Verlag Berlin Heidelberg, 2008.
[28] H. Okamura, H. Kobayashi, T. Dohi, Markovian modeling and analysisof internet worm propagation, in: Proc. 16th IEEE Int. Symp. SoftwareReliability Engineering ISSRE 2005.
[29] M. A. Rajab, J. Zarfoss, F. Monrose, A. Terzis, My botnet is bigger thanyours (maybe, better than yours): why size estimates remain challenging,in: Proceedings of the first conference on First Workshop on Hot Topicsin Understanding Botnets, USENIX Association, 2007.
r_pubs/Damballa_2010_Top_10_Botnets_Report.pdf.[31] J. R. Douceur, The sybil attack, in: Revised Papers from the First Inter-
national Workshop on Peer-to-Peer Systems, IPTPS ’01, Springer-Verlag,London, UK, 2002, pp. 251–260.
[32] The honeynet project, 2011. [Online]. Available: http://www.
honeynet.org/.[33] J. Rrushi, E. Mokhtari, A. A. Ghorbani, A statistical approach to bot-
net virulence estimation, in: Proceedings of the 6th ACM Symposiumon Information, Computer and Communications Security, ASIACCS ’11,ACM, 2011, pp. 508–512.
[34] D. Zwillinger, Handbook of Diff. Eqs., Academic Press, 1997. 3rd Ed.[35] A. D. Polyanin, V. F. Zaitsev, Handbook of exact solutions for ordinary
differential equations, Chapman & Hall/CRC, 2 edition, 2003.[36] P. L. Sachdev, A compendium on nonlinear ordinary differential equa-
tions, John Wiley & Sons, Inc., 1997.[37] S. Kondratenya, E. Prolisko, The existence and the form of solutions of
lienard equations with a moving algebraic singularity, Differential Equa-tions 9 (1973) 198–201.
[38] M. Khosroshahy, M. K. Mehmet-Ali, D. Qiu, The sic botnet lifecyclemodel: A step beyond traditional epidemiological models (accompanyingtech report: Mathematica derivations), 2012. [Online]. Available: http://www.masoodkh.com/files/papers/SIC/SIC-TechReport.pdf.
