Pattern Programmable Kernel Filter for Bot Detection

Defence Science Journal

Vivek Kumar Pandey¹  Kritika Govind¹  S. Selvakumar¹ 

[1] National Institute of Technology, Tiruchirappalli

关键词: Command and control;    SpyEye exploit kit;    WFP-windows filtering platform;    kernel;    zombie;   

DOI  :  

学科分类：社会科学、人文和艺术（综合）

来源: Defence Scientific Information & Documentation Centre

【 摘 要 】

Bots earn their unique name as they perform a wide variety of automated task. These tasks include stealing sensitive user information. Detection of bots using solutions such as behavioral correlation of flow records, group activity in DNS traffic, observing the periodic repeatability in communication, etc., lead to monitoring the network traffic and then classifying them as Bot or normal traffic. Other solutions for Bot detection include kernel level key stroke verification, system call initialization, IP black listing, etc. In the first two solutions there is no assurance that the packet carrying user information is prevented from being sent to the attacker and the latter suffers from the problem of IP spoofing. This motivated us to think of a solution that would filter out the malicious packets before being put onto the network. To come out with such a solution, a real time bot attack was generated with SpyEye Exploit kit and traffic characteristics were analyzed. The analysis revealed the existence of a unique repeated communication between the Zombie machine and the botmaster. This motivated us to propose, a Pattern Programmable Kernel Filter (PPKF) for filtering out the malicious packets generated by bots. PPKF was developed using the windows filtering platform (WFP) filter engine. PPKF was programmed to filter out the packets with unique pattern which were observed from the bot attack experiments. Further PPKF was found to completely suppress the flow of packets having the programmed uniqueness in them thus preventing the functioning of bots in terms of user information being sent to the Botmaster. Defence Science Journal, 2012, 62(1), pp.174-179 , DOI:http://dx.doi.org/10.14429/dsj.62.1425

【 授权许可】

Unknown