Identifying and Characterizing Bashlite and Mirai C&C Servers

Autor:	Klaus Steding-Jessen, Italo Cunha, Elverton Fazzion, Artur Marzano, Dorgival Guedes, Cristine Hoepers, Gabriel Bastos, H P C Chaves Marcelo, Wagner Meira, Osvaldo Fonseca
Rok vydání:	2019
Předmět:	Honeypot business.industry Computer science Botnet 020207 software engineering 02 engineering and technology computer.software_genre Software 020204 information systems Server 0202 electrical engineering electronic engineering information engineering Malware business computer Computer network
Zdroj:	ISCC
DOI:	10.1109/iscc47284.2019.8969728
Popis:	IoT devices are often a vector for assembling massive botnets, as a consequence of being broadly available, having limited security protections, and significant challenges in deploying software upgrades. Such botnets are usually controlled by centralized Command-and-Control (C&C) servers, which need to be identified and taken down to mitigate threats. In this paper we propose a framework to infer C&C server IP addresses using four heuristics. Our heuristics employ static and dynamic analysis to automatically extract information from malware binaries. We use active measurements to validate inferences, and demonstrate the efficacy of our framework by identifying and characterizing C&C servers for 62% of 1050 malware binaries collected using 47 honeypots.
Databáze:	OpenAIRE
Externí odkaz:	https://explore.openaire.eu/search/publication?articleId=doi_________::4110924411d72ce4678aebfd7fa83628 https://doi.org/10.1109/iscc47284.2019.8969728 Zobrazit plný text záznamu